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INTRODUCTION 


Although  the  concept  of  command  and  control  (C2)  is  firmly  embedded  in  U.S. 
warfighting  doctrine,  organization,  technology,  and  operations,  a  definitive  method  for 
cyberspace  C2  has  not  been  established  across  the  joint  force.  This  despite  ample  evidence  that 
the  joint  force  is  not  optimally  organized  for  C2  of  cyberspace  operations.  Ongoing  intrusions 
to  the  tune  of  6  million  per  day  and  massive  exfiltration  of  information  remain  unabated. 

Attacks  appear  to  be  growing  ever  more  sophisticated  and  difficult  to  detect.  In  addition,  the 
Armed  Forces’  offensive  capabilities  are  unnecessarily  segmented,  being  that  both  the  legal 
authorities  and  technical  capabilities  are  wholly  enabled  by  agencies  other  than  the  Department 
of  Defense.  This  situation  critically  reduces  the  responsiveness  to  combatant  and  joint  task  force 
commanders  and  increases  the  difficulty  of  integrating  cyberspace  capabilities  into  operational 
plans  and  execution. 

The  central  thesis  of  this  paper  is  that  any  approach  to  cyberspace  command  and  control 
must  be  founded  on  the  nature  of  the  cyberspace  domain  itself  To  investigate  this  thesis,  this 
study  examines  possible  alternatives  for  cyberspace  C2  that  are  based  on  the  nature  of  the 
strategic  environment,  the  nature  of  the  cyberspace  domain  itself,  and  the  way  in  which  conflict 
must  be  approached  in  this  domain  in  order  to  improve  the  Armed  Forces’  ability  to  successfully 
compete  in  cyberspace.  The  paper  provides  background  on  the  pertinent  threats  arising  in 
cyberspace;  the  definition  of  cyberspace;  and  the  natures  of  the  strategic  environment, 
cyberspace,  and  competition  in  cyberspace.  Next,  a  review  of  C2  models  and  associated 
organizational  forms,  including  the  current  DoD  approach  is  presented.  A  set  of  cyberspace  C2 
criteria  is  then  derived  followed  by  an  analysis  of  the  models  in  light  of  the  criteria.  Using  the 
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results  of  the  analysis,  implications  for  C2  with  particular  emphasis  on  organizational  structure 
will  be  addressed. 
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BACKGROUND 


In  late  2005,  several  media  outlets  published  reports  of  a  DoD  codenamed  computer 
intrusion  set  titled  Titan  Rain.  These  reports  outlined  a  concerted  and  lengthy  effort  by  supposed 
Chinese  computer  hackers  who  were  systematically  infiltrating  DoD  systems  across  the  globe. 
Their  intrusions  were  described  as,  “They  would  commandeer  a  hidden  section  of  a  hard  drive, 
zip  up  as  many  files  as  possible  and  immediately  transmit  the  data  to  way  stations  in  South 
Korea,  Hong  Kong  or  Taiwan  before  sending  them  to  mainland  China.  They  always  made  a 
silent  escape,  wiping  their  electronic  fingerprints  clean  and  leaving  behind  an  almost 
undetectable  beacon  allowing  them  to  re-enter  the  machine  at  will.  An  entire  attack  took  10  to  30 
minutes.”' 

These  intrusions  resulted  in  huge  amounts  of  data  being  transferred  outside  the  U.S.  to 
ultimate  destinations  unknown.  While  the  actual  types  and  specifics  of  the  data  lost  remains 
classified,  suffice  it  to  say  they  included  operational  and  tactical  relevant  information  that  could 
assist  an  adversary.  More  disturbing  is  that  the  intrusions  could  take  place  at  ah  and  that  it 
normally  takes  the  DoD  quite  a  long  time  to  even  notice  an  intrusion  has  taken  place.  This  does 
not  bode  well  for  a  zero-day  intrusion  which  is  integrated  into  a  more  conventional-type  of  an 
attack.  The  point  of  the  zero-day  attack  would  be  to  slow  our  response  down  long  enough  to 
give  our  adversary  an  asynchronous  advantage  with  the  end  result  being  dominance  over  U.S. 
forces. 

To  meet  these  and  other  intrusion  attempts,  the  DoD  has  relied  upon  a  very  hierarchical 
and  authority-lacking  organizational  Command  and  Control  structure  that  finds  itself  in  a 
reactive,  defensive  crouch  vice  executing  active  defense  measures  enabling  it  to  pre-empt  the 
many  intrusions  while  keeping  cyberspace  available  and  allowing  freedom  of  action  for  ah  the 
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users  and  war  fighters.  More  speeifieally,  the  military  is  using  the  traditional  template  of 
assigning  responsibility,  without  adequate  authority,  to  a  single  Combatant  Command 
(COCOM),  United  States  Strategic  Command  (STRATCOM).  As  this  paper  shows,  it  is  widely 
recognized  that  cyberspace  is  declared,  at  the  highest  levels,  as  the  newest  domain  of  warfare. 
However,  unlike  the  other  warfighting  domains,  cyberspace  responsibilities  are  assigned  to  a 
COCOM  vice  a  “service  equivalent.”  Service  equivalent  means  that  primary  air  responsibilities 
reside  with  the  Air  Force,  land  operations  to  the  Army,  and  maritime  to  the  Navy  and  Marine 
Corps.  For  these  domains,  no  one  COCOM  executes  operational  responsibilities  across  other 
COCOM’s  lines  of  authority  and  responsibility.  Nor  do  the  various  service  chiefs  attempt  to 
direct  air,  land,  or  maritime  operations  within  a  different  COCOM.  Not  so  with  cyberspace:  for 
this  domain,  the  military  treats  a  domain  of  warfare  organizationally  different  while  utilizing 
conventional  C2  structures  resulting  in  significant  C2  challenges. 

However,  functional  component  commands  do  exercise  combatant  command  authority 
over  assets  of  all  the  services  not  unlike  geographical  combatant  commanders  do  once  they  are 
assigned  or  attached  forces.  But  the  similarity  ends  there.  Unlike  the  functional  commands, 
STRATCOM  does  not  enjoy  the  ability  to  command  and  control  the  service’s  cyberspace  forces 
in  a  unified  manner  to  ensure  cyberspace  superiority. 

Nowhere  is  this  borne  out  more  than  in  the  military’s  own  documentation  regarding  C2  of 
cyberspace.  Joint  Task  Force  -  Global  Network  Operations  (JTF-GNO),  the  DoD’s  operational 
and  tactical  command  for  cyberspace,  published  the  Joint  Concept  of  Operations  (CONORS)  for 
Global  Information  Grid  Network  Operations  (GIG  NetOps)  in  2006.  In  this  document,  JTF- 
GNO  published  a  chart  (Figure  1)  designed  to  help  guide  it  in  deciding  when  and  how  it  might 
intervene  and  exercise  C2  over  the  GIG  during  an  event. 
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Figure  1:  JTF-GNO  matrix  to  manage  incidents 


As  one  can  see,  the  DoD  is  using  charts  and  old-fashioned,  geographically  based  thinking 


in  an  attempt  to  delineate  artificial  C2  boundaries  when  the  global  nature  of  cyberspace  argues 


against  this  approach. 


Some  might  claim  that  cyberspace  is  purely  an  enabler  best  viewed  as  a  functional  area. 


Even  if  this  were  true,  the  current  command  structure  does  not  accord  with  the  nature  of  the 


domain.  Unlike  United  States  Transportation  Command  (TRANSCOM),  United  States  Joint 


Forces  Command  (JFCOM)  or  other  functional  COCOMs  which  are  organized  around  their 


functional  area,  cyberspace  is  relegated  to  one  of  many  missions  under  the  STRATCOM 


umbrella. 


Further  complicating  the  picture  is  a  recent  Secretary  of  Defense  directed  organizational 
change.  In  a  November  2008  memo.  Secretary  Gates  directed  the  Commander  of 
USSTRATCOM  to  “place  Joint  Task  Force  -  Global  Network  Operations  (JTF-GNO)  under  the 
operational  control  of  Commander,  Joint  Functional  Component  Commander  -  Network  Warfare 
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(JFCC-NW).  This  arrangement  further  creates  gaps  and  seams  as  the  DoD  attempts,  through  a 
traditional,  hierarchical  approach,  to  exercise  C2  over  the  cyberspace  domain.  Instead,  the 
environment  in  which  cyberspace  is  embedded  necessitates  a  C2  structure  that  recognizes, 
embraces,  and  takes  advantage  of  the  non-geographic  nature  of  cyberspace. 

The  cyberspace  environment  can  best  be  characterized  by  the  acronym  VUCA: 

Volatility,  Uncertainty,  Complexity  and  Ambiguity.  As  this  paper  illustrates,  rapid  technological 
advances  and  increases  in  the  use  and  pervasiveness  of  cyberspace  coupled  with  aggressive 
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adversaries  create  a  volatile  environment.  Both  the  DoD  and  the  world  as  a  whole  are  uncertain 


about  the  future  uses  and  exploitations  which  will  occur  in  cyberspace  along  with  the  impact  to 
our  military  and  society  should  the  current  intmsions  we  suffer  from  advance  into  a  destructive 
manner.  The  technological  aspects  of  the  domain  and  the  way  the  domain  is  used  show  how 
difficult  it  is  to  understand  this  domain.  All  of  these  factors,  along  with  the  challenges  of 
attributing  cyberspace  intrusions,  combine  to  create  an  environment  of  frustrating  ambiguity. 

The  correct  military  response  lies  in  establishing  a  C2  structure  for  this  new  domain  so  that  the 
Armed  Forces  can  not  only  execute  day-to-day  defense  but  also  light  through  future  intrusions  in 
time  of  war. 
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CYBERSPACE:  A  DEFINITION 


To  begin  a  discussion  on  Cyberspace,  one  must  first  define  and  reach  a  common 
understanding  of  the  term.  Much  writing  on  this  topic  has  occurred  over  the  past  decade  as 
cyberspace  matured  and  we  collectively  realized  a  new  domain  and  form  of  warfare  had 
materialized. 

The  term  “cyberspace”  has  come  to  be  accepted  universally  as  what  we,  as  humans, 
created  and  now  inexorably  rely  upon  both  in  a  military  and  civilian  sense.  Cyberspace  was  first 
coined  by  the  novelist  William  Gibson  in  his  1982  story  titled  ''Burning  Chrome”  and  then 
published  in  his  1984  novel  "Necromancer.”'^  However,  his  definition  differs  greatly  from  what 
our  current  understanding  of  the  term  cyberspace.  To  wit,  he  defines  cyberspace  as:  “A 
consensual  hallucination  experienced  daily  by  billions  of  legitimate  operators,  in  every  nation,  by 
children  being  taught  mathematical  concepts...  A  graphic  representation  of  data  abstracted  from 
banks  of  every  computer  in  the  human  system.  Unthinkable  complexity.  Lines  of  light  ranged  in 
the  nonspace  {sic)  of  the  mind,  clusters  and  constellations  of  data.  Like  city  lights,  receding.”^ 

As  one  can  quickly  tell,  Gibon’s  idea  of  cyberspace  hardly  applies  to  our  reality.  Like  the 
previous  Joint  Publication  1-02  (DoD  dictionary)  definition  of  cyberspace,  the  universal 
understanding  of  cyberspace  does  not  include  a  description  of  a  “consensual  hallucination”, 
“unthinkable  complexity”,  or  “lines  of  light.”  Although  we  have  embraced  the  term  cyberspace, 
we  quickly  rejected  the  definition  submitted  by  the  creator  of  the  term. 

Enamored  with  the  possibilities  of  cyberspace,  the  term  was  employed  in  many  contexts 
with  many  different  meanings  and  definitions.  As  alluded  to  before,  the  accepted  DoD 
definition  as  published  in  Joint  Pub  1-02  prior  to  August  2006  stated  that  cyberspace  is  the 
“notional  environment  in  which  digitized  information  is  communicated  over  computer 
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networks.”^  Once  again,  the  eoneept  of  a  “notional  environment”,  i.e.  one  that  does  not  exist 
exeept  in  one’s  mind,  is  eneountered.  As  there  are  very  real,  physieal  pieees  to  eyberspaee,  this 
definition  does  not  aeeurately  deseribe  eyberspaee.  However,  efforts  to  properly  define 
eyberspaee  or  diseuss  the  very  nature  of  eyberspaee  in  any  type  of  offieial  eapaeity  were  met 
throughout  the  past  deeade  with  hostility,  indifferenee,  and  outright  stonewalling. 

In  2003,  the  President  of  the  United  States  reeognized  the  importanee  of  eyberspaee  to 
the  nation  and  attempted  to  define  eyberspaee  in  the  National  Strategy  to  Seeure  Cyberspaee, 
“Cyberspaee  is  eomposed  of  hundreds  of  thousands  of  intereonneeted  eomputers,  servers, 
routers,  switehes,  and  fiber  optie  cables  that  allow  our  eritieal  infrastruetures  to  work.”’  While 
an  admirable  effort,  eoordinated  aeross  the  entire  United  States  Government  (USG),  this 
definition  deals  mainly  with  hardware  aspeets  of  the  domain  and  fails  to  reeognize  that 
eyberspaee  is,  in  faet  a  domain,  and  does  not  really  add  more  to  the  diseussion  past  the  definition 
provided  by  the  DoD  in  Joint  Pub  1-02. 

A  signifieant  breakthrough  oeeurred  with  the  publieation  of  the  2006  Quadrennial 
Defense  Review  (QDR).  The  QDR  is  the  DoD  fulfillment  of  the  statutory  requirement  in  United 
States  Code  Title  10,  Seetion  118  whieh  requires  the  DoD  to  “. .  .eonduet  a  eomprehensive 
examination  (to  be  known  as  a  "  quadrennial  defense  review")  of  the  national  defense  strategy, 
foree  strueture,  foree  modernization  plans,  infrastrueture,  budget  plan,  and  other  elements  of  the 
defense  program  and  polieies  of  the  United  States  with  a  view  toward  determining  and 
expressing  the  defense  strategy  of  the  United  States  and  establishing  a  defense  program  for  the 
next  20  years.  Eaeh  sueh  quadrennial  defense  review  shall  be  eondueted  in  eonsultation  with  the 

o 

Chairman  of  the  Joint  Chiefs  of  Staff.”  This  high-level  doeument,  a  eoordinated  effort  aeross 
the  entire  Joint  Staff,  aeknowledged  eyberspaee  is,  in  faet,  a  domain  not  unlike  the  traditional 
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domains  of  warfare  (air,  land,  sea).  However,  the  QDR  in  a  sense,  baeked  into  the  deelaration  of 
cyberspace  as  a  domain  by  treating  it  as  a  fait  accompli.  It  used  the  term  cyberspace  as  a  de 
facto  domain  as  illustrated  passages  pulled  from  the  document; 

•  “Capabilities  to  locate,  tag  and  track  terrorists  in  all  domains,  including 
cyberspace.”^ 

•  “contribute  to  the  nation’s  response  to  and  management  of  the  consequences  of 
WMD  attacks  or  a  catastrophic  event,  such  as  Hurricane  Katrina,  and  also  to  raise 
the  level  of  defense  responsiveness  in  all  domains  (e.g.,  air,  land,  maritime,  space 
and  cyberspace)  if  directed.”'” 

Having  treated  cyberspace  as  a  domain,  the  QDR  did  not  find  it  necessary  to  define  the 
domain,  leaving  that  for  follow-on  efforts.  However,  it  did  create  the  necessary,  official 
environment  to  begin  shaping  the  discussion  towards  cyberspace  being  officially  declared  as  a 
domain  of  warfare  with  all  the  associated  challenges  and  opportunities. 

Immediately  building  upon  the  efforts  of  the  QDR  and  driven  by  foreign  intrusions 
against  the  NIPRNet,  the  Joint  Staff,  Communications  and  Information  Directorate  (J-6),  led  a 
Chairman  of  the  Joint  Chiefs  of  Staff  directed,  staff-wide  effort  to  develop  a  strategy  to  deal  with 
cyberspace.  As  part  of  the  effort  to  create  the  first-ever  National  Military  Strategy  for 
Cyberspace  Operations  (NMS-CO),  the  authors  arrived  at  a  DoD-wide  coordinated  definition  of 
cyberspace;  “a  domain  characterized  by  the  use  of  electronics  and  the  electromagnetic  spectrum 
to  store,  modify  and  exchange  data  via  networked  systems  and  associated  physical 
infrastructures.”!  1  As.  Dr.  Kamal  T.  Jabbour,  Senior  Scientist  for  information  assurance  at  Air 
Force  Rome  Labs  accurately  points  out,  “the  word  “domain”  instead  of  “environment”  carries 
legal  implications  under  the  laws  of  armed  conflict.  “Electronics  and  the  electromagnetic 
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spectrum”  refer  to  the  wave-particle  duality  of  radiation  which,  when  modulated  with 
information,  creates  a  signal.  “Data  and  networked  systems”  refer  to  digital  information  and 
application  programs,  and  the  computers  and  networks  on  which  they  exist,  in  other  words  data 

1 3 

and  applications,  at  rest  and  in  motion.” 

In  other  words,  cyberspace  consists  of  more  than  the  TCP/IP  based  Internet,  though  to  be 
sure  it  is  the  Internet  that  currently  dominates  what  most  people  think  of  as  cyberspace.  There 
are  thousands  of  protocols,  software  architectures,  and  hardware  implementations  that  comprise 
cyberspace.  This  includes  non-Internet  Protocol  based  networks  such  as  specialized  military 
networks,  networks  not  connected  to  the  Internet,  and  networks  that  use  different  or  proprietary 
communications  protocols.  Examples  include  Link  16  networks  which  use  a  time  domain 
multiple  access  method  and  standardized  message  formats  and  the  Signaling  System  7  protocol 
which  ties  together  the  world’s  telephone  switch  network.  The  point  here  is  that  cyberspace  is 
more  than  just  Internet-based  computer  networks. 

Building  upon  the  definition  provided  by  the  NMS-CO,  the  OSD  staff  continued  to  refine 
the  definition  and  finally  arrived  at  the  current  definition  which  is  incorporated  into  Joint  Pub  1- 
02  and  is  the  official  DoD  definition  of  cyberspace:  “A  global  domain  within  the  information 
environment  consisting  of  the  interdependent  network  of  information  technology  infrastructures, 
including  the  Internet,  telecommunications  networks,  computer  systems,  and  embedded 
processors  and  controllers.”'"^  This  definition  is  sufficient  to  enable  further  discussion  about 
cyberspace,  its  place  within  the  traditional  domains  of  warfare,  and  the  need  to  establish  effective 
command  and  control  structures  enabling  the  military  to  operate  effectively  within  and  through 
the  domain. 
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THE  NATURE  OF  CYBERSPACE 


One  central  and  vital  point  must  be  understood:  the  value  of  cyberspace  is  derived  from 
the  information  that  flows  through  it.  This  continuous,  massive  exchange  of  information  has 
made  cyberspace  indispensable  to  modern  civilization  and,  thus,  central  to  modern  military 
operations.  The  volume  of  internet  traffic  per  year,  estimated  to  range  from  3000  to  5000 
Petabytes  (10^^  bytes) and  the  fact  that  overall  internet  traffic  is  growing  at  50  to  60  percent 
per'^,  are  enough  to  provide  ample  support  for  this  assertion.  This  phenomenon  results  from  a 
combination  of  technological,  economic,  and  sociological  factors  and  gives  rise  to  a  rich, 
dynamic,  and  ever-growing  web  of  human- to-human,  human-to-machine,  and  machine-to- 
machine  interactions.  New  applications,  such  as  “Web  2.0”  or  social  networking,  digital 
television  streaming,  and  the  “executable  internet”  promise  to  open  innovative  avenues  to 
conduct  commerce,  stay  in  touch,  and  fight  wars.  The  Armed  Forces  would  do  well  to  anticipate 
disruptive  threats  to  emerge  from  cyberspace  given  its  facility  to  generate  innovation  and  create 
cross-cutting  change. 

Innovation  and  change  is  a  hallmark  of  cyberspace.  It  is  important  to  understand  that  the 
cyberspace  infrastructure,  like  the  information  that  flows  through  it,  will  not  remain  static.  The 
technologies  and  architectural  approaches  that  comprise  cyberspace  will  continue  to  change  over 
time,  meaning  that  the  fabric  of  cyberspace  itself  will  evolve.  Advances  in  electronics 
fabrication,  integration,  and  production;  improved  computing  architectures  and  networking 
methods,  information  exchange  methods,  and  emerging  nanotechnologies  and  biotechnologies 
promise  to  transform  today’s  cyberspace  into  ever  more  potent  forms  with  more  powerful 
capabilities  for  information  transmission,  storage,  processing,  and  depiction.  Another  critical 
point  is  that  cyberspace  will  continue  to  become  increasingly  complex,  especially  in  terms  of 
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scale  and  control.  Cyberspace  is  comprised  of  billions  of  devices,  each  with  its  own  hardware, 
software,  and  purpose  with  billions  to  follow.  This  results  in  an  extremely  heterogeneous 
systems  environment  that  is  becoming  less  and  less  amenable  to  direct  and  pervasive  human 
control.  From  a  military  standpoint,  this  evolutional  reality  drives  an  enduring  requirement  for 
aggressive  science  and  technology  research  that  will  in  turn  translate  into  systematic  alignment 
and  fielding  of  effective  cyberspace  operational  capabilities. 

Cyberspace:  A  man-made  domain  of  warfare 

Cyberspace  is  both  linked  to  and  distinguished  from  air,  land,  sea,  and  space  in  that  it  is  a 
man-made  domain  established  through  the  use  of  electronic  technology  and  software,  firmware, 
and  hardware  programs  specifically  designed  to  manipulate  electromagnetic  energy  into  encoded 
signals.  In  one  sense,  cyberspace  is  exactly  like  the  other  physical  domains  in  that  it  relies  on  a 
scientific  reality — in  this  case  the  electromagnetic  spectrum — that  is  governed  by  physical  laws 
(e.g.  Maxwell’s  equations).  However,  cyberspace  differs  from  the  other  domains  in  that 
technology  is  an  essential  factor  for  its  existence.  Cyberspace  is  a  man-made  domain  in  the 
sense  that  the  transmission  of  encoded  electro-mechanical  signals  is  only  possible  through  the 
use  of  human  designed,  manufactured,  and  organized  electronics-based  technology. 

Cyberspace  is  also  similar  to  the  other  domains  in  that  it  is  globally  distributed  which  add 
to  the  C2  complexities.  Unlike  the  other  domains,  cyberspace  is  owned  by  commercial,  state,  or 
private  interests.  It  is  not  as  some  would  say  a  “global  commons”  or  “a  natural  asset  outside 
national  jurisdiction  such  as  the  oceans,  outer  space,  and  the  Antarctic.”'^  Within  some  areas  of 
the  Department  of  Defense  the  term  global  commons  has  taken  on  a  sort  of  buzzword  status  and 
is  used  to  support  strategic  concepts  that  have  U.S.  military  forces  engaged  in  the  protection  of 
access  to  the  global  commons.  Except  for  very  narrow  situations  such  as  public  cable  access  or 
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amateur  radio  frequencies,  the  principles  of  sovereignty,  property  rights,  and  commercial 
enterprise  apply  to  cyberspace  which  in  turn,  under  U.S.  and  international  law,  places  constraints 
on  when  and  how  military  force  can  be  used  in  cyberspace. 

The  effort  to  classify  cyberspace  as  a  part  of  the  global  commons  is  best  viewed  as  a 
movement  to  internationalize  its  control  and  subject  it  supra-national  legal  regimes.  This 
controversy  centers  largely  around  the  Internet,  which  since  1992,  has  been  overseen  by  a 
consortium  of  commercial,  governmental,  academic,  and  research  organizations  under  the 
auspices  of  the  Internet  Society.  In  addition,  the  Internet  Corporation  for  Assigned  Names  and 
Numbers  (ICANN),  which  controls  the  assignment  of  Internet  address  space  and  is  contracted  to 
the  United  States  Department  of  Commerce  to  perform  this  task  on  behalf  of  all  Internet  users, 
has  come  under  fire  from  both  commercial  and  governmental  interests  as  to  whether  ICANN  has 
the  authority  to  accept  or  reject  the  establishment  of  new  domains.  The  Internet  Society  and 
ICANN  exemplify  the  regulatory  and  standards  complexity  that  accompany  operations  in 
cyberspace. 

Cyberspace  is  also  distinguished  from  the  other  domains  by  its  potential  to  drive 
extremely  high  operational  speeds.  Whereas  operations  in  the  other  domains  are  subject  to  much 
lower  limits  on  speed  due  to  gravitational,  hydrodynamic,  astrophysical,  propulsive,  and  ballistic 
forces,  cyberspace  operations  can  occur  at  much  higher  speeds.  For  instance,  the  transmission  of 
optical  signals  has  been  registered  at  two-thirds  the  speed  of  light  which  is  orders  of  magnitude 
faster  than  speeds  achieved  in  the  other  domains.  Practical  examples  include  AT&T’s  40 
Gigabit  per  second  transmission  capability  on  its  Internet  backbone'^  and  the  1.2  seconds  it  takes 
for  a  one-way,  end-to-end,  geosynchronous  satellite  transmission  .  The  speed  at  which  events 
occur  in  cyberspace  serves  to  transform  the  classic  time-space  planning  factor  by  reducing  the 
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tyrannies  of  time  and  distance.  With  innovations  occurring  continuously,  the  upper  limit  of 
operational  speed  in  cyberspace  will  only  continue  to  increase. 

However,  increased  operational  speed  is  not  automatic  and  is  attenuated  by  a  number  of 
factors.  Perhaps  most  obviously,  speed  is  affected  by  machine  failures  and  faults.  In  addition, 
just  as  in  the  other  domains,  adversary  operations  and  effectiveness  of  friendly  planning, 
decision-making,  and  operational  processes  will  place  a  drag  on  operational  speed.  Unless 
cyberspace  operations  are  thoroughly  augmented  with  technological  automation — to  include 
more  precise  and  cogent  methods  for  producing  situational  awareness  and  moment-by-moment 
domain  understanding — the  human-induced  latency  associated  with  planning  and  decision¬ 
making  will  negatively  impact  operational  tempos,  resulting  in  a  failure  to  capitalize  on  the 
potentially  high  speeds  afforded  by  the  domain. 

Another  limitation  on  operations  is  the  difficult  task  of  tracing  and  attributing  malicious 
activity  in  cyberspace.  Adversaries  conduct  attacks  using  multiple  nodal  hops  and  diverse 
network  paths  that  can  transit  many  national  boundaries.  Even  if  an  attack  is  successfully  traced, 
it  becomes  another  task  altogether  to  correlate  the  attack  to  the  actor  who  initiated  it,  all  of  which 
takes  time.  In  addition,  anonymity  is  readily  achieved  using  obfuscation,  masquerade,  and 
deception  techniques.  With  sufficient  expertise,  especially  when  augmented  by  knowledge 
available  in  the  Internet,  cyberspace  becomes  a  sanctuary  where  information  exchanges  are 
conducted  in  secrecy  and  large-scale  attacks  can  be  launched  with  low  probability  of  attribution. 
This  affords  a  tremendous  asymmetric  advantage  to  a  cyberspace  attacker. 

Asymmetric  advantage  is  also  associated  with  the  ease  at  which  cyberspace  can  be 
accessed.  Operating  in  cyberspace  is  an  inexpensive  proposition  as  compared  to  the  costs  of 
entry  to  compete  militarily  in  the  other  domains,  especially  air  and  space.  Commercial 
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computing  technology  and  connectivity  can  be  readily  obtained  along  with  extremely 
sophistieated  attaek  and  exploitation  tools.  Suecessfully  eompeting  in  eyberspaee  is  not 
restricted  solely  to  nation-states.  Organized  erime  and  extremist  organizations  increasingly 
exhibit  the  type  of  agility  and  innovation  previously  reserved  for  state -run  military-intelligenee 
establishments  to  eonduet  sophisticated  technieal  operations.  As  the  scale  and  reaeh  of 
eyberspaee  eapabilities  grows,  non-state  aetors  should  be  expeeted  to  inereasingly  use 
eyberspaee  as  an  asymmetrie  offset  to  a  state’s  eonventional  forces  and  teehnieal  means  while 
state  aetors  will  gain  skill  in  the  eonduet  and  integration  of  eyberspaee  operations  with 
operations  in  air,  land,  sea,  and  spaee.  Because  of  its  dependenee  on  eyberspaee,  the  United 
States  is  espeeially  vulnerable  to  sueh  operations. 

Another  intrieacy  of  the  eyberspaee  domain  is  that  very  little  in  the  way  of  international 
law  exists  with  regard  its  use.  Unlike  the  other  domains,  from  a  legal  standpoint,  eyberspaee  is 
not  yet  eonsidered  a  “plaee”  as  sueh  and  therefore  traditional  territorial-based  law  for 
international  eonduet  does  not  apply  cleanly  to  the  domain.  Given  the  speed  and  general 
anonymity  with  whieh  information  flows,  it  is  difficult  to  clearly  delineate  a  state’s  territorial 
boundary  in  cyberspace  at  any  given  moment.  Such  a  capability  would  require  the  instantaneous 
mapping  of  eleetronie  traffie  flows  to  preeise  geographie  points  and  the  teehnieal  and  proeedural 
means  to  identify  and  poliee  such  flows.  In  addition,  since  eyberspaee  is  based  on  an  open- 
aeeess  philosophy  that  is  embedded  within  the  protoeols  and  arehiteeture  upon  whieh  it  is  built, 
“feneing  off’  the  domain  into  territorial  seetions  would  require  a  massive  re-engineering  of  its 
fundamental  arehiteeture.  So  the  legal  problem  is  as  mueh  eoneeptual  and  teehnieal  as  it  is  legal, 
whieh  confounds  the  seareh  for  a  solution.  In  the  meantime,  in  the  international  arena,  it  ean  be 
said  that  all  aetors  have  tremendous  freedom  of  aetion  in  eyberspaee. 
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Cyberspace  -  U.S.  Legal  Authorities 


Within  the  United  States  government,  legal  authorities  for  cyberspace  are  distributed 
among  several  different  departments,  agencies,  and  commissions.  The  United  States  Code 
prescribes  defense  in  Title  10,  commerce  in  Title  15  (technical  standards-making),  law 
enforcement  in  Title  18,  intelligence  gathering  in  Title  50,  and  communications  regulation  in 
Title  154  (Federal  Communications  Commission).  In  addition,  the  National  and  Homeland 
Security  Councils  have  shared  responsibility  for  cyberspace  policy  making,  and  Congress  shapes 
the  cyberspace  legal  environment  through  law-making,  legislative  language,  and  funds 
appropriation.  In  contrast  to  the  international  arena,  domestically,  cyberspace  operations  must 
adhere  to  legal  regimes  concerned  with  law  enforcement,  intelligence  gathering,  and  use  of 
military  force.  Issues  germane  to  cyberspace  operations  include  homeland  defense  and  posse 
comitatus;  right  to  privacy,  eavesdropping,  and  the  Foreign  Intelligence  Surveillance  Act,  and 
the  right  of  self  defense  under  Article  5 1  of  the  United  Nations  charter. 

With  regard  to  the  inherent  right  of  self  defense,  of  particular  interest  is  the  question  of 
when  a  cyber  attack  becomes  an  act  of  military  aggression  as  opposed  to  espionage.  Certainly, 
there  have  been  large  scale  cross-border  cyberspace  intrusions  (e.g.  Estonia  and  Georgia),  but  in 
that  case  neither  the  United  Nations  nor  NATO  moved  to  declare  the  event  an  act  of  military 
aggression.  A  Schmitt  analysis  yields  two  factors  making  such  a  declaration  problematic: 
presumptive  legitimacy  and  responsibility,  which  gets  to  the  issue  of  attribution.  Presumptive 
legitimacy  holds  that,  “only  states  have  the  State  actors  have  a  monopoly  on  the  legitimate  use  of 
kinetic  force,  while  other  non-kinetic  actions — attacks  through  or  in  cyberspace — are  often 
permissible  in  a  wider  set  of  circumstances;  actions  that  have  not  been  the  sole  province  of 
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nation-states  are  less  likely  to  be  viewed  as  military.  ”  Also,  “if  a  state  takes  visible 
responsibility  for  any  destruetive  aet,  it  is  more  likely  to  be  eharaeterized  as  a  traditional  military 
operation.^"^  Therefore,  this  ambiguity  makes  it  mueh  more  diffieult  to  deelare  a  eyber  event  an 
attaek.  As  eompared  to  the  other  operational  domains,  sueh  grey  areas  in  international  law 
affords  both  state  and  non-state  actors  considerable  cover  to  conduct  wide-ranging  cyberspace 
operations  with  potentially  severe  effects.  However,  if  an  event  were  classified  as  an  attack,  a 
response  by  a  nation-state,  including  one  that  uses  cyberspace,  would  have  to  adhere  the  Law  of 
Armed  Conflict  tenets  of  military  necessity,  distinction,  proportionality,  and  chivalry.  In  this 
regard,  the  legal  requirements  for  military  operations  in  cyberspace  are  no  different  than 
operations  in  air,  land,  sea,  and  space. 

Further  regulatory-like  influence  is  exercised  in  the  technical  arena  by  industry 
consortiums  and  standards-making  bodies.  This  complex  of  legal,  regulatory,  and  standards 
structures — while  facilitating  free  enterprise,  respect  for  privacy  and  property  rights — creates 
inherent  hurdles,  obstacles,  and  barriers  for  the  conduct  of  cyberspace  operations.  To  be  sure, 
thoughtful  change  is  always  an  option  to  reduce  complexity  when  it  comes  to  the  conduct  of 
cyberspace  operations,  but  the  most  pragmatic  approach  is  for  military  practitioners  to 
acknowledge  this  complexity,  incorporate  it  into  their  plans,  find  ways  to  increase  cooperation 
with  others  who  have  interests  in  cyberspace,  and  use  existing  structures  to  the  best  military 
advantage  while  working  to  implement  positive  change. 

Defending  Cyberspace 

Perhaps  the  most  significant  asymmetric  advantage  afforded  to  an  adversary  is  derived 
from  the  difficulty  of  defending  a  globally  distributed,  highly  technical  domain.  There  are 
literally  hundreds  of  millions  of  addressable  devices  that  comprise  cyberspace  that  use  both 
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network  communications  protocol  stacks  and  computer  software  and  hardware  stacks.  Add  to 
this  the  ubiquity  of  the  electromagnetic  spectrum,  and  the  immensity  of  the  defensive  task 
becomes  clear.  Report  after  report  of  intrusions  and  growing  attack  sophistication  provide 
irrefutable  evidence  that — at  the  moment — cyberspace  operations  favors  the  offense. 

The  preceding  analysis  of  cyberspace  characteristics  has  revealed  the  multi-dimensional 
nature  of  cyberspace.  Fundamentally,  cyberspace  is  a  man-made,  evolving,  and  technological 
domain  firmly  rooted  in  the  scientific  reality  of  electromagnetics.  It  relies  on  electronic  devices, 
including  communications  switches  and  computer  processors,  to  transmit  and  process  modulated 
signals.  Cyberspace  is  not  a  global  commons,  but  rather  is  owned,  although  the  standards  which 
underpin  its  technological  fabric  are  largely  a  cooperative  enterprise.  In  addition,  cyberspace  is 
based  on  an  architecture  designed  for  efficient  and  resilient  data  exchange.  These  three  factors — 
commercial  electronics,  ownership,  and  ease  of  data  exchange — have  given  rise  to  situation 
wherein  both  access  to  the  domain  and  acquisition  of  sophisticated  data  manipulation  tools  are 
inexpensive.  Skilled  practitioners  can  use  access  and  tools  to  great  operational  effect  given  the 
speed  and  anonymity  at  which  events  occur  under  cover,  as  it  were,  of  complex  maze  of 
international,  domestic  legal,  regulatory,  and  standards  frameworks.  Given  that  cyberspace 
operations  currently  favor  the  offense,  cyberspace,  properly  used,  can  deliver  an  asymmetric 
advantage  to  both  state  and  non-state  actors.  For  nation-states,  cyberspace  operations  promise  to 
be  another  powerful  component  of  joint  warfare;  however  the  Armed  Forces  must  move  out  to 
achieve  domain  mastery  to  make  the  promise  a  reality. 

Cyberspace  is  an  enabler  of  globalization;  rapid  technological  innovation;  and  faster 
decision-making,  product  development,  and  service  delivery  cycles.  These  factors  all  serve  to 
shift  and  undermine  the  status  quo  not  only  in  business,  but  also  in  government  policy  making 
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and  social  discourse.  If  an  organization  is  to  prosper,  premiums  must  be  plaeed  on  knowledge 
about  the  environment  and  the  speed  with  whieh  organizations  ean  aet  to  take  advantage  of 
opportunities  or  deal  with  ehallenges.  Riehard  A.  D’Aveni  deseribes  this  situation  as 
hypereompetition.  Hypereompetition  is,  “an  environment  eharaeterized  by  intense  and  rapid 
eompetitive  moves,  in  which  competitors  must  move  quiekly  to  build  new  advantages  and 
[simultaneously]  erode  the  advantages  of  their  rivals.”  Organizational  survival  hinges  on  the 
eapaeity  for  strategie  and  operational  flexibility,  leadership  agility,  and  the  ability  to  employ 
aggressive  strategies  to  radieally  shift  the  status  quo  and  destroy  eompetitor  advantage. 
Experimentation,  rapid  learning,  and  adaptation  are  prized,  while  penalties  can  be  severe  for 
slow  and  inappropriate  responses. 

Hypereompetition  is  a  strong  metaphor  for  fundamental  task  of  the  Armed  Forces,  that  is, 
fighting  and  winning  the  nations  wars  in  a  VUCA  operational  environment.  From  a  warfighting 
standpoint,  hypereompetition  evokes  coneepts  like  full  speetrum  dominanee,  the  Clausewitzian 
Trinity,  and  operational  art,  that  conceive  of  warfare  as  an  intensely  competitive  struggle 
against  eunning  adversaries  where  measure  is  met  by  eountermeasure  in  a  lethal  struggle  to  gain 
supremaey.  In  a  similar  manner,  cyberspaee  operations  exemplify  the  hypereompetitive 
metaphor  as  these  operations  are  eondueted  in  the  very  domain  that  drives  the  hypereompetitive 
reality.  The  Armed  Forces  are  de  facto  eompetitors  in  this  domain  in  much  the  same  way  as 
eommereial  industry  is,  with  the  additional  eomponent  of  eombat. 

In  cyberspaee,  eompetition  moves  at  a  rapid  rate  in  part  due  the  speed  at  which 
technology  changes.  Therefore,  any  eompetitive  advantage  aehieved  in  cyberspaee  is  tenuous 
and  transient,  and  military  superiority  must  be  viewed  as  temporary,  loeal,  and  continually  at 
risk.  Just  as  successful  business  organizations  must  have  the  ability  to  quiekly  eoneeive  of  and 
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employ  technological  solutions  to  challenges  arising  in  and  from  the  domain,  so  must  the  Armed 
Forces,  especially  in  terms  of  cyber  defense.  Success  requires  the  Armed  Forces  to  effectively 
deal  with  rapid  change  and  complexity  in  order  to  achieve  efficacy  in  support  of  national  security 
priorities,  requirements  that  are  especially  pertinent  for  cyberspace  operations. 
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COMMAND  AND  CONTROL  AND  THE  CYBERSPACE  DOMAIN 


Command  and  control  is  often  misunderstood  and  not  surprisingly  so.  Surveys  of  C2 
literature  reveal  a  wide-variety  of  definitions,  approaehes,  and  models.  In  order  to  provide  a 
common  intellectual  framework  for  understanding  the  eommand  and  control  models  to  be 
discussed,  this  section  will  describe  how  the  term  eommand  and  eontrol  emerged.  In  addition, 
partieular  attention  will  be  paid  to  the  mateh  of  organizational  form  to  C2.  Of  central  importance 
to  this  diseussion  is  W.  Ross  Ashby’s  law  of  requisite  variety,  whieh  states  that  an  organization's 
internal  regulatory  mechanisms  must  be  as  diverse  as  the  environmental  within  whieh  it  is 
embedded.  Building  on  Ashby,  Henk  Volberda  further  asserts  that  the  ability  to  deal  with  a 
hypereompetitive  threat  is  directly  related  to  how  well  an  organization  is  struetured  internally  to 
mateh  the  environment.  An  organization  with  variety  is  eapable  of  adapting  appropriately  to 
their  environment  or  adapting  their  environment  to  benefit  of  the  organization.  In  the  VUCA 
environment,  eareful  eonsideration  is  needed  to  aseertain  whieh  organizational  model  will 
perform  best  as  the  ehoiee  will  directly  on  the  C2  method  deployed  to  support  the  organization’s 
mission.  Choiees  must  be  made  between  stability  and  flexibility,  speeialization  and 
generalization,  and  eentralization  and  deeentralization.  Too  mueh  internal  complexity  and 
operating  eosts  go  up.  Too  little,  and  the  organization  will  not  produee  the  requisite  variety 
needed  to  survive.  It  is  elear  that  the  eorreet  ehoiee  of  organizational  form  is  eritieal  to  aehieving 
eyberspaee  superiority. 

After  establishing  a  eommon  understanding  of  C2,  three  main  models  for  C2,  with 
important  variants,  are  presented;  the  historieal-traditional  model  (whieh  ineludes  the  eurrent 
DoD  approaeh  to  eyberspaee  C2),  the  eybernetie-systems  model,  and  the  eognitive-psychologieal 
model.  These  models  are  also  linked  to  the  positive  and  negative  eharaeteristies  of  the  following 
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organizational  forms:  hierarchical,  heterarchical,  and  hybrid.  These  models  are  then  vetted  in 
terms  of  enduring  C2  criteria  with  particular  focus  on  C2  organization  and  authorities.  A 
recommendation  will  then  be  made  on  a  cyberspace  C2  approach  and  what  actions  must  be  taken 
to  implement  it. 


HISTORICAL-TRADITIONAL  MODEL 

The  roots  of  the  modern  understanding  of  C2  can  be  traced  to  the  industrial  revolution 
with  its  requirements  for  the  direction  of  large  organizations  engaged  in  complex  mass- 
production  processes.  From  this  viewpoint,  C2  is  synonymous  with  the  hierarchic  organizational 
form  and  the  emergence  of  the  professional  bureaucracy.  Early  organizational  pioneers  like  Max 
Weber,  Frederick  Taylor,  and  Frank  and  Fillian  Gilbreth  studied  bureaucratic  organization,  work 
design,  work  measurement,  standardization,  and  production  control  in  order  to  best  take 
advantage  of  the  division  of  labor  and  specialization  of  tasks  and  thereby  increase  production 
output  and  efficiency.  Alfred  P.  Sloan  is  credited  with  establishing  the  modem  hierarchical  form 
of  industrial  organization  with  his  divisional  stmcture.  This  stmcture  emphasizes  strict 
hierarchical  command  chains,  centralized  finance  and  planning,  cross-divisional  integration  at 
the  corporate  level,  and  tight  control  of  and  reporting  on  highly  prescribed  production  activities. 
This  basic  stmcture  endures  not  only  in  the  business  arena  but  also  in  the  organization  of  the 
Armed  Forces  as  seen  in  the  stmcture  employed  to  mobilize  for  and  conduct  the  Second  World 
War,  the  Defense  Reorganization  Act  of  1947,  and  the  Goldwater-Nichols  Act  of  1987.^"^ 

From  a  technical  perspective,  the  development  of  C2  as  an  organizational  function 
reached  new  heights  during  the  Second  World  War.  The  challenges  brought  on  by  the  war 
resulted  in  the  intensified  development  and  use  of  mathematical  methods  to  work  on  complex 
military  command  and  control  problems  such  as  anti-air  defense,  dynamic  ballistic  firing 
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solutions,  large  scale  logistics  movements,  and  production  and  resource  allocation  decisions. 
During  this  period  and  shortly  thereafter,  statistical  methods,  operations  research,  linear 
programming,  control  theory,  and  systems  analysis  were  applied  to  these  problems  on  a  nearly 
wholesale  basis.  In  addition,  the  use  of  the  first  computers  allowed  mathematicians  to  solve 
more  and  more  complex  problems  is  less  time.  With  the  aid  of  computers,  advanced 
computational  methods  were  developed  for  simulation  and  forecasting  of  future  results  and  to 
increase  the  efficiency  of  a  hierarchical  organization’s  processes.  The  increasing  use  of 
computers  to  actually  perform  organizational  control  functions  contributed  to  the  identification 
of  C2  as  inherently  technology-enabled  and  thereby  served  to  blur  the  distinction  between  the 
purpose  of  command  and  the  purpose  of  control.  In  essence,  the  two  were  viewed  as 
synonymous.  Further  evolution  of  C2  occurred  during  the  Cold  War  as  increasingly 
sophisticated  and  comprehensive  computerized  command  and  control  systems  were  developed. 

The  Cold  War  ushered  in  yet  another  era  of  scientific  development  given  the  need  to 
ensure  positive  control  of  the  destructive  power  of  nuclear  weapons  and  their  delivery  platforms, 
inform  procurement  decisions  for  increasingly  complex  weapon  systems,  manage  the 
development  and  production  of  these  systems,  model  and  simulate  nuclear  warfare  scenarios,  and 
direct  the  actual  conflict.  With  regard  to  nuclear  conflict,  it  was  quickly  recognized  that  nuclear¬ 
armed  jet  bombers,  and  soon  thereafter  ballistic  missiles,  dramatically  reduced  the  time  to  detect 
and  intercept  Soviet  equivalents.  This  fact  drove  the  need  for  a  responsive  and  reliable  command 
and  control  system,  and  one  based  on  state-of-the-art  communications  and  computing 
technology.  Due  to  the  consequences  of  nuclear  conflict  and  the  requirement  to  retain  tight 
control  of  its  inherent  destructive  power,  the  function  of  command — the  authority  to  direct 
military  forces — ^was  seen  as  inextricably  tied  to  the  organizational,  procedural,  and  technical 
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apparatus  that  allowed  command  to  be  exercised.  To  address  this  situation,  the  military  designed 
and  implemented  a  tightly-coupled  command  and  control  system  composed  of  computerized 
command,  control,  and  communications  systems  and  highly  specified  operational  procedures  that 
were  in  turn  reinforced  by  rigorous  training,  exercise,  and  inspection  standards.  This  highly 
prescribed  and  vertically  integrated  C2  system  resulted  in  positive  weapons  control,  assured 
receipt  of  orders,  and  high  launch  probability  from  the  order  to  launch  at  the  Presidential  level  to 
the  turning  of  keys  in  missile  silos. 


National  Command  Authority 


•  Trains  &  equips 


Figure  2:  Joint  Publication  1,  Doctrine  for  the  Armed  Forces  of  the  United  States,  2007. 

Historical-traditional  C2  is  virtually  synonymous  with  the  hierarchical  organizational 

form,  and  they  have  performed  well  during  the  industrial  age  and  for  modern  government 
bureaucracies  (Figure  2).  Hierarchical  organizations  have  a  pyramidal  structure  and  are 
characterized  by  specified  superior-subordinate  chains  of  command,  specialization  by  function, 
uniform  policies  covering  rights  and  duties,  standardized  procedures  for  each  job,  a  career  based 
on  promotions  for  technical  competence,  impersonal  relations,  and  all  coordination  being  done 
from  a  level  above  from  the  work  being  coordinated.  Hierarchical  organizations  reduce 
transaction  costs  by  increasing  scale  and  by  placing  control  of  resources  into  the  hands  of  top- 
level  managers.  Hierarchies  are  well  matched  to  stable,  predictable  environments  and  large-scale 
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production.  Hierarchies  take  advantage  of  the  division  of  labor  and  economies  of  seale  for 
known,  struetured  problems  where  there  is  less  of  a  requirement  to  eoordinate  and  share 
information  aeross  functional  lines  of  authority.  Position,  rank,  and  experience  are  of 
paramount  importanee  with  regard  to  power  relationships,  deeision-making  authority,  and 
eontrol  of  resourees.  Power  and  decision-making  authority  are  coneentrated  at  the  top  of  the 
hierarehy  and  deerease  as  one  moves  to  the  lower  levels  of  the  organization.  Hierarehies  also 
ereate  stovepipes,  whieh  are  vertical,  tightly  coupled  eomponent  organizations  that  are  optimized 
for  narrowly  foeused  funetions,  e.g.  intelligenee,  logistics,  maintenance,  ete.  The  systems  that 
support  hierarehies  are  built  and  eontrolled  by  these  stovepipes,  making  interoperability  diffieult 
to  aehieve  whieh  in  turn  drives  the  need  for  systematie  eoordination  and  integration  if  the 
organization  is  to  aehieve  its  overall  purpose.  Information  flow  in  a  hierarehy  is  neeessarily 
aggregated  and  filtered  as  it  moves  up  the  organization.  Lower  level  elements  therefore  have  the 
most  detailed  loeal  knowledge  of  the  environment  whereas  leaders  at  the  top  of  the  hierarehy 
have  a  broader  pieture  of  the  global  environment  in  whieh  the  organization  operates.  Courses  of 
aetion  are  eonstrueted  globally  at  the  highest  eommand  level  and  are  progressively  distilled 
down  at  eaeh  subordinate  layer  of  eommand.  Information  flows  within  a  hierarehy  are  largely 
eonfined  to  the  stovepipes  that  ereated  the  information.  There  is  little  incentive  to  share 
information  given  that  it  is  a  source  of  knowledge — and  therefore  power — within  the 
organization.  Given  the  time  it  takes  for  information  to  flow  from  the  bottom  of  the  organization 
to  the  top,  deeision-making  time  horizons  and  perspeetives  are  different  between  levels,  yielding 
an  asymmetry  of  deeision-making  foeus.  For  the  top  of  the  pyramid,  the  longer  time  horizon  and 
the  higher  position  in  the  hierarehy  results  in  deeisions  that  are  larger  in  seope  and  longer  in 
term. 
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The  historical-traditional  military  command  and  control  model  is  closely  tied  to  the 
hierarchical  form.  However,  despite  its  success,  the  effectiveness  of  the  hierarchical  form  is 
challenged  by  environmental  complexity,  accelerating  change,  and  hypercompetition. 

Hierarchies  are  slow  to  respond  to  environmental  changes  in  part  due  to  the  restricted,  up-and- 
down  flow  of  information.  Although  hierarchies  can  sometimes  respond  quickly  to  crises,  they 
can  lack  the  requisite  variety  to  respond  appropriately.  Horizontal  communication  is  hampered 
and  functional  loyalties  of  stovepipes  inhibit  communication,  problem  solving,  and  coordination. 
The  focus  on  efficiency  means  functional  components  can  make  decisions  that  benefit  them 
rather  than  the  organization  as  a  whole.  Interests  become  entrenched  and  the  organization  as  a 
whole  resists  change.  Experience  and  position  can  be  more  prized  than  knowledge  leading  to 
poor  decisions  or  lack  of  acceptance  of  new  ideas. 

Fast  forward  to  today,  and  it  is  readily  apparent  that  the  definition  of  C2  in  Joint 
Publication  1-02  is  at  least  partially  a  product  of  this  industrial-age,  nuclear-era  understanding  of 
command  and  control.  The  DoD,  for  example,  defines  command  and  control  as,  “the  exercise  of 
authority  and  direction  by  a  properly  designated  commander  over  assigned  and  attached  forces  in 
the  accomplishment  of  the  mission.  Command  and  control  functions  are  performed  through  an 
arrangement  of  personnel,  equipment,  communications,  facilities,  and  procedures  employed  by  a 
commander  in  planning,  directing,  coordinating,  and  controlling  forces  and  operations  in  the 
accomplishment  of  the  mission.”  Embedded  in  this  definition  are  the  traditional-historical 
notions  of  hierarchy;  authority;  and  management  of  scale,  complexity,  and  force.  This 
understanding  results  in  a  distinct  military  approach  to  C2  that  tightly  couples  the  functions  of 
command  and  control  for  the  purpose  of  controlling  military  force  in  a  hierarchical  organization. 
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With  regard  to  current  DoD  organization  for  cyberspace  C2,  at  the  top  of  the  hierarchy  is 
STRATCOM).  STRATCOM  is  tasked,  via  the  Unified  Command  Plan  (UCP),  to  defend  the 
Armed  Forces’  (GIG),  the  military-only  portion  of  cyberspace.  The  means  that  STRATCOM 
has  the  combatant  command  authority  to  operate  and  defend  the  GIG.  Indeed,  STRATCOM 

-5  "7 

states  part  of  its  mission  is  “to  ensure  US  freedom  of  action  in  space  and  cyberspace.”  To 
accomplish  this  mission,  STRATCOM  established  two  subordinate  commands:  Joint  Function 
Combatant  Command  -  Network  Warfare  (JFCC-NW)  and  Joint  Task  Force  -  Global  Network 
Operations  (JTF-GNO).  JFCC-NW  is  responsible  for  coordinating  and  executing  offensive 
operations  enabled  by  the  National  Security  Agency’s  (NSA)  exploitative  cyberspace  operations. 
JTF-GNO  executes  its  mission  to  operate  and  defend  military  cyberspace  through  the  issuance  of 
various  operational  and  defensive  orders  to  subordinate  commands.  These  orders  direct  GIG 
configuration  changes,  defensive  measures,  and  reporting  requirements.  Until  recently,  these 
two  organizations,  while  reporting  to  STRATCOM,  were  separate.  However,  understanding  the 
lack  of  synergy  and  C2  difficulties  encountered  by  “splitting”  offense  and  defense,  the  DoD 
acted  to  remedy  this  with  the  November  2008  Secretary  of  Defense  memo  that  placed  JTF-GNO 
under  the  operational  control  of  JFCC-NW.  Interestingly,  both  the  commanders  of  JTF-GNO 
and  JFCC-NW  maintain  their  current  dual-hatted  roles:  The  3-star  commander  of  JTF-GNO  is 
also  the  Defense  Information  Systems  Agency  commander  and  the  3 -star  commander  of  NSA  is 
also  the  JFCC-NW  commander. 

Within  the  USAF,  the  top  level  organization  for  cyberspace  now  resides  with  24**'  Air 
Force  under  Air  Force  Space  Command  (AFSPC).  Through  24**^  Air  Force,  the  USAF  operates 
and  defends  its  portion  of  cyberspace  through  Air  Force  Network  Operations  (AFNETOPS) 
command.  It  is  from  this  organization  that  all  operational  and  defensive  actions  are  directed  for 
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Air  Force  cyberspace.  AFNETOPS  executes  C2  of  cyberspace  through  two  Network  Operations 
and  Security  Centers  (NOSC).  Each  NOSC  is  assigned  certain  Air  Force  Bases  and  are  fully 
responsible  to  operate  and  defend  the  cyberspace  that  affects  these  bases.  Agreements  between 
the  NOSCs  and  base  communications  squadron  delineate  responsibilities  and  help  to  ensure  that 
the  two  organizations  do  not  duplicate  work.  The  implications  for  this  arrangement  is  that  Wing 
Commanders  have  lost  control  of  base-level  computer  network  and  have  no  say  in  the  decisions 
regarding  the  operations  and  defense  of  the  base  network.  Rather,  these  decisions  are  now  made 
AFNETOPS  or  the  NOSCs.  Another  challenge  arises  when  a  squadron  deploys  to  another 
combat  command  thereby  falling  within  that  COCOM’s  authority. 
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Figure  3:  Current  DoD  Cyberspace  C2 
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Figure  3  shows  the  dual  chain  of  command  a  communications  squadron  operates  under  in 
a  deployed,  wartime  environment.  Unlike  the  air,  land,  sea,  and  space  domains,  there  is  no 
discussion  of  combatant,  operational,  or  tactical  command  as  one  expects  regarding  a  domain  of 
warfare.  Instead  there  are  two  lines  of  command  authority  directing  the  cyberspace  activities  of 
a  base  communications  squadron  in  a  deployed  environment.  This  arrangement  not  only  causes 
confusion  and  duplication  of  effort  but  also  violates  the  principle  of  warfare  known  as  Unity  of 
Command.  Compounding  the  confusion  is  that  fact  that  the  Air  Force  NOSCs,  which  direct  all 
activity  on  AF  networks,  are  outside  of  the  combatant  command’s  chain  of  command.  Further, 
the  Combatant  Command  is  outside  the  functional  line  regarding  how  the  Air  Force  operates, 
trains,  and  equips  its  forces.  In  the  final  analysis,  the  DoD,  services,  and  combatant  commands 
have  established  a  traditional-hierarchical  command  and  control  structure  that  undermines  unity 
of  command,  conflates  the  roles  of  the  services  and  Combatant  Commands,  and — most 
critically — hamstrings  the  Armed  Forces’  ability  to  rapidly  adapt  to  events  and  innovations 
arising  in  the  cyberspace  domain.  This  situation  unnecessarily  constrains  freedom  of  action  and 
prevents  the  agility  needed  to  successfully  operate  in  the  domain. 

In  order  to  exercise  cyberspace  C2,  legal  authority  must  be  assigned  to  a  commander. 
Under  the  current  cyberspace  C2  construct,  combatant  command  and  services  authorities  overlap 
and  are  poorly  defined,  further  complicating  C2.  The  new  UCP  attempts  to  clarify  some  of  these 
authority  issues  by  clearly  breaking  out  cyberspace  operations  as  a  new  responsibility  for 
STRATCOM  Commander.  Specifically,  the  new  UCP  states: 

‘USSTRATCOM  is  responsible  for  synchronizing  planning  for  cyberspace  operations, 
and  will  do  so  in  coordination  with  other  combatant  commands,  the  Services,  and  as  directed, 
appropriate  U.S.  government  agencies.  USSTRATCOM's  specific  responsibilities  include: 

(a)  Directing  Global  Information  Grid  operations  and  defense. 

(b)  Planning  against  designated  cyberspace  threats. 
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(c)  Coordinating  with  other  combatant  commands  and  appropriate  U.S.  government 
agencies  prior  to  the  generation  of  cyberspace  effects  that  cross  areas  of  responsibility. 

(d)  Providing  military  representation  to  U.S.  national  agencies,  U.S.  commercial  entities, 
and  international  agencies  for  matters  related  to  cyberspace,  as  directed. 

(e)  Advocating  for  cyberspace  capabilities. 

(f)  Integrating  theater  security  cooperation  activities,  deployments,  and  capabilities  that 
support  cyberspace  operations,  in  coordination  with  the  geographic  combatant  commanders,  and 
making  priority  recommendations  to  the  Secretary. 

(g)  Planning  OPE  [operational  preparation  of  the  environment],  and  as  directed, 
executing  OPE  or  synchronizing  execution  of  OPE  in  coordination  with  the  geographic 
combatant  commanders. 

(h)  Executing  cyberspace  operations,  as  directed.  ” 

At  first  glance,  this  appears  to  show  that  STRATCOM  is  in  charge  of  the  operation  and 
defense  of  cyberspace  or  at  least  the  GIG.  However,  in  lengthy  tank  sessions,  a  new  phrase  was 
defined  and  it  becomes  a  critical  point  for  this  new  UCP.  Specifically,  the  tank  defined  the 
phrase  “synchronize  planning”  to  mean: 

“Combatant  Commanders  charged  with  synchronizing  planning  lead  a  global 
collaborative  planning  process  that  includes  other  Combatant  Commanders,  Services,  Combat 
Support  Agencies,  and  applicable  Defense  agencies  and  Eield  Activities  in  support  of  a 
designated  global  mission  or  campaign  plan.  The  phrase  "synchronizing  planning"  pertains 
specifically  to  planning  efforts  only  and  does  not,  by  itself,  convey  authority  to  execute 
operations  or  direct  execution  of  operations."^^ 

This  shows  that  disagreement  remains  between  STRATCOM,  the  other  combatant 
commands,  and  the  services  regarding  overall  authority  for  conducting  cyberspace  operations. 
The  issue  at  hand  is  whether  STRATCOM  ought  to  have  the  authority  to  direct  cyberspace 
operations  within  another  Combatant  Command’s  area  of  responsibility.  Although  the  2008 
UCP  attempts  to  resolve  some  of  this  disagreement  by  specifically  mentioning  cyberspace  and 
assigning  the  mission  to  STRATCOM,  the  UCP  stops  short  of  assigning  STRATCOM  the  full 
authority  to  conduct  cyberspace  operations  across  the  globe  by  the  inclusion  of  the  phrase 
“synchronize  planning.”  In  effect,  this  phrase  allows  the  other  Combatant  Commands  and 
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services  to  disregard  STRATCOM  directives  with  which  they  disagree.  There  remains  no  clear 
authority  for  cyberspace  C2. 

This  attempt  to  bring  cyberspace  operations  under  the  command  of  a  single  COCOM  will 
also  cause  other  issues.  For  example,  cyberspace  activities  such  as  network  maintenance  fall 
under  the  purview  of  the  respective  service,  not  a  combatant  command."^'  However,  in  a  recent 
memorandum,  the  Secretary  of  Defense  recently  approved  a  definition  for  cyberspace  operations: 
“The  employment  of  cyber  capabilities  where  the  primary  purpose  is  to  achieve  military 
objectives  or  effects  in  or  through  cyberspace.  Such  operations  include  computer  network 
operations  and  activities  to  operate  and  defend  the  Global  Information  Grid.”"^^  The 
memorandum  goes  on  to  clarify  several  points: 

The  term  “cyberspace  operations”  is  consistent  with  the  language  used  in  the  National 
Military  Strategy  for  Cyberspace  Operations,  Presidential  directives,  and  the  draft  2008  Unified 
Command  Plan. 

The  methodology  used  for  defining  “cyberspace  operations”  is  consistent  with  other 
joint  operational  definitions. 

“Cyberspace  operations”  should  encompass  current  computer  network  operations  and 
activities  to  operate  and  defend  the  Global  Information  Grid."^^ 

The  first  two  points  are  significant  because  it  shows  an  attempt  to  forestall  any  further 
complaints  or  objections  about  this  definition  by  declaring  cyberspace  operations  to  be  fully 
consistent  with  all  salient  documentation  currently  published.  The  second  point  establishes 
cyberspace  operations  as  an  official  DoD  definition,  to  be  incorporated  into  the  DoD  dictionary 
of  terms,  JP  1-02.  However,  the  third  point  is  significant  because  it  states  network  attack  and 
network  defense  fall  under  cyberspace  operations,  and  includes  activities  to  “operate  and  defend 
the  Global  Information  Grid.”  When  viewed  in  light  of  the  draft  2008  UCP,  it  appears  that 
operations  and  maintenance  activities,  legally  a  service  responsibility,  is  now  assigned  to  a 
combatant  command.  This  creates  a  situation  where  in  two  separate  entities — STRATCOM  and 
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the  services — could  validly  claim  the  authority  to  direct  military  cyberspace  operations  in 
accordance  with  Title  10  of  the  U.S.  code  and  DoD  guidance.  Some  would  argue  that 
STRATCOM  can  avoid  this  issue  by  labeling  all  its  cyberspace  directives  as  defensive  in  nature, 
which  is  well  within  their  purview,  versus  operations  and  maintenance,  the  purview  of  the 
services.  However,  it  is  inevitable  that  the  services  will  protest  this  situation  as  an  encroachment 
on  their  congressionally  mandated  Title  10  authorities  to  organize,  train  and  equip  forces. 

The  current  arrangement  for  cyberspace  C2  mixes  authorities  and  as  such  will  continue  to 
constrain  the  ability  of  the  Armed  Forces  to  conduct  responsive  cyberspace  operations.  The 
issues  associated  with  STRATCOM,  other  combatant  commands,  and  service  prerogatives  must 
be  dealt  with  and  call  for  a  complete  rethinking  of  the  DoD’s  approach  to  cyberspace  C2. 

We  argue  that  such  an  understanding  of  C2  is  inappropriately  restrictive  for  the 
cyberspace  domain.  What  is  needed  is  an  approach  to  C2  that  allows  more  flexibility  to 
conceptualize  and  match  the  fundamental  purpose  of  C2  to  the  environment  in  which  it  is 
exercised.  Toward  this  end,  we  follow  Bremer  and  Orr  who  view  the  purpose  of  C2  as  the 
direction  and  coordination  of  operations  to  produce  desired  effects  according  to  commander’s 
intent  through  the  positioning  of  forces  at  the  time  and  place  they  are  needed."^"^  From  this 
perspective,  effective  command  seeks  to  gain  competitive  advantage  by  controlling  the  military 
power  distribution."^^  Control  is  achieved  by  gathering  information  about  the  operational 
environment,  synthesizing  the  information  to  understand  what  actions  must  be  taken,  and 
translating  that  understanding  into  orders  and  direction  that  are  executed  through  one’s  forces. 
This  understanding  of  C2  emphasizes  goal,  adversary  (environment),  and  process  rather  than 
specification  of  authority,  command  chains,  and  organizational  structure  which  unnecessarily 
limits — perhaps  catastrophically — the  action  required  of  the  C2  system.  Given  this 
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understanding  we  examine  other  alternatives  for  eyberspaee  C2  and  eommensurate 
organizational  forms. 

SYSTEMS  THEORY  AND  THE  CYBERNETIC-SYSTEMS  MODEL 

First  artieulated  by  Ludwig  von  Bertalanffy,  a  biologist,  in  his  book  General  Systems 
Theory,'^''  systems  theory  offers  prineiples  and  methods  with  whieh  to  study  the  interaetions, 
relationships,  and  strueture  of  any  set  of  interaeting  entities  (a  system).  Systems  theory  therefore 
takes  a  holistie  perspeetive  instead  of  a  reduetionist  one:  the  behavior  of  a  system  is  understood 
from  the  interaetions  of  its  parts  rather  than  a  detailed  understanding  of  eaeh  of  its  parts. 

Systems  theory  is  direeted  toward  the  analysis  of  “any  group  of  objeets  that  work  in  eoneert  to 
produee  some  result.  This  eould  be  a  single  organism,  any  organization  or  soeiety,  or  any 
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eleetro-meehanioal  or  informational  artifaet.”  Based  on  Bertalanffy’s  study  of  biologie 
organisms,  two  basie  prineiples  eharaeterize  systems  theory,  “First,  all  phenomena  ean  be 
viewed  as  a  web  of  relationships  among  elements,  or  a  system.  Seeond,  all  systems, 
whether  eleetrieal,  biologieal,  or  soeial,  have  eommon  patterns,  behaviors,  and  properties  that 
ean  be  understood  and  used  to  develop  greater  insight  into  the  behavior  of  eomplex 
phenomena.”"^^  Systems  theory  also  endeavors  to  understand  the  interaetions,  proeesses, 
relationships,  and  maero-behavior  of  the  interdependent  parts  as  a  whole.  Espeeially  important 
are  the  eomplexity  of  the  relationship  of  systems  to  their  environments  and  the  ability  of  systems 
to  adjust  to  ehanges  in  the  environment.  Key  prineiples  of  systems  theory  are  shown  in  Figure  4. 

-  A  system  is  a  dynamie,  eomplex,  and  interdependent  whole,  interaeting  as  a  struetured 
funetional  unit 

-  A  system  is  holistie,  exhibiting  emergent  properties  not  possible  to  deteet  by  analysis  of 
individual  parts 

-  A  system  is  a  eommunity  situated  within  an  environment 

-  Energy,  materiel,  and  information  flow  among  the  different  elements  that  eompose  the 
system 

-  The  elements  of  the  system  are  differentiated  and  perform  speeialized  funetions 
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-  Energy,  material,  and  information  flow  from  and  to  the  surrounding  environment  via  semi- 
permeable  membranes  or  boundaries 

-  Energy,  materiel,  and  information  are  transformed  outputs  through  proeesses  by  which  the 
goals  are  achieved 

-  Systems  are  often  composed  of  entities  seeking  equilibrium  but  can  exhibit  other  types  of 
behavior  (e.g.  chaotic,  oscillating) 

-  Systems  are  regulated  through  feedback 

-  Systems  can  comprise  parts  of  larger  systems 

-  A  system  is  goal  seeking,  meaning  that  systemic  interaction  must  result  in  some  goal  or 
final  state 

-  Systems  exhibit  equifinality,  alternative  ways  of  attaining  the  same  objectives 
(convergence),  and  multifinality:  attaining  alternative  objectives  from  the  same  inputs 
(divergence) 

Figure  4:  Key  Principles  of  Systems  Theory^" 


The  cybemetic-system  model  is  the  dominant  C2  paradigm  for  nearly  all  researchers  and 
systems  builders  and  either  explicitly  or  implicitly  informs  all  C2  models  (see  Figure  5).  A 
cybernetic  system  is  composed  of  three  fundamental  components:  sensors  that  accept  input  from 
the  environment,  processors  that  accept  the  input  and  transform  it,  and  output  mechanisms  that 
take  the  processed  information  and  use  it  to  change  the  behavior  of  the  system.  The  cybernetic 
aspect  of  military  operations  is  readily  apparent  given  these  operations  are  a  process  by  which  a 
commander  (sensor  and  processor)  directs  forces  (people,  processes/ors,  and  technology 
organized  into  a  system  to  produce  output)  to  achieve  comparative  advantage  over  an  adversary 
(interaction  with  the  environment)  through  maneuver  and  the  application  of  firepower  (output 
and  feedback).  The  science  of  cybernetics  studies  internal  and  external  interactions  “guided  by 
the  principle  that  numerous  different  types  of  systems  can  be  studied  according  to  principles  of 
feedback,  control,  and  communications.”^^  Also  key  to  understanding  the  concept  of  cybemetics 
is  the  idea  of  self-regulation.  When  a  system  senses  a  change  in  the  environment,  that 
information  is  used  to  adjust  the  behavior  according  to  the  goal  of  the  system.  The  system  then 
monitors  the  environment  to  ascertain  if  either  the  internal  or  external  change  has  successfully 
aligned  with  the  system’s  goal. 
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Cybernetic  Model 


The  Basic  Cybernetic  Modei 
(sources:  Wiener,  1948;  von  Bertaianffy,  1968) 


Key  Characteristics  of  the  Cybernetic  Modei: 

-  Self-regulation/self-adaptation 

-  Feedback  loop 

-  Control 

-  Information 
(source:  Wiener,  1948) 


EMERGED  OUT  OF  WWII  AND  IS  THE  FOUNDATION  OF 
THE  OVERWHELMING  MAJORITY  OF  C2  MODELS 


Figure  5:  The  Cybernetic  Modei.  (Sources:  Wiener,  1948  and  Bertaianffy,  1968). 


Management  eyberneties  applies  the  prineiples  of  cybemeties  and  systems  theory  to 
organizations.  Pioneered  by  Stafford  Beer  in  1959,  management  cybernetics  examines  the 
problems  of  control  and  decision-making  and  the  development  of  models  in  terms  of  the 
organization’s  goals;  inputs,  transformation  of  inputs,  and  outputs;  regulation,  control,  and 
feedback;  and  capability  to  generate  a  variety  of  responses  to  environmental  challenges.  Beer’s 
Viable  System  Model  (Figure  6)  is  an  abstracted  cybernetic  description  applicable  to  any 
organization  that  is  a  viable  system  and  capable  of  autonomy.  Beer  developed  the  Viable  System 
Model  as  a  conceptual  tool  for  designing,  implementing,  and  reengineering  organizations  in 
order  to  improve  an  organization’s  ability  to  adapt  and  survive  in  its  environment.  Beer’s 
model  examines  five  major  elements  that  an  organization  depends  of  to  achieve  its  purpose; 
operations,  coordination  between  elements  in  the  organization,  activity  and  resources  that 
optimize  the  organization  in  relation  to  its  environment,  the  organization’s  environment,  and 
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normative  rules  and  regulations.  The  model  then  diagnoses  the  information  flows  that  tie  all  the 
elements  together  in  terms  of  sufficieney  and  richness.  Multi-channel  robustness  is  emphasized 
especially  as  they  allow  the  organization’s  structures  and  processes  to  work  and  deal  with 
changes  in  the  environment.  Control,  regulation,  and  communication  are  also  optimized 
according  to  what  the  organization  must  do  to  be  successful  in  its  current  operations,  for  its 
future,  and  in  terms  of  its  long  term  identity  and  values. 


Figure  6:  The  Viable  System  Model.  (Source:  Stafford  Beer,  1966). 
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MODELS  DERIVED  FROM  COMPLEXITY  THEORY 


The  principles  of  cybernetics  and  systems  theory  have  in  turn  informed  the  development 
of  complexity  theory.  Complexity  theory  is  a  special  application  of  systems  theory,  founded  on 
biological  science  and  the  behavior  of  living  organisms.  It  can  be  defined  as,  “. .  .any  system 
featuring  a  large  number  of  interacting  components,  whose  aggregate  activity  is  nonlinear  and 
typically  exhibits  hierarchical  self-organization  and  evolving  behavior  when  placed  under  stress 
from  its  environment.”^"^  From  an  organizational  standpoint,  complexity  theory  is  used  to 
explain  how  organizations  adapt  and  survive  in  their  environments.^^  John  H.  Holland,  a 
complex  and  nonlinear  systems  pioneer,  cites  such  characteristics  as  self-organization,  emergent 
behavior,  dispersed  control,  and  adaptability  as  hallmarks  of  a  complex  organization  (Figure  6). 
Self-organization  is  a  process  of  attraction  and  repulsion  in  which  the  internal  organization  of  a 
system,  normally  an  open  system,  increases  in  complexity  without  being  guided  or  managed  by 
an  outside  source.  Emergence  is  the  process  of  deriving  new  and  coherent  structures,  patterns, 
and  properties  as  an  organization  works  to  fit  itself  to  the  environment.  Emergent  phenomena 
occur  due  to  the  pattern  of  interactions  between  the  elements  of  the  system  over  time  and  are 
observable  at  a  macro-level,  even  though  they  are  generated  by  micro-level  elements. 

Emergence  is  also  related  to  dispersed  control  in  that  decisions  are  made  by  a  variety  of  elements 
in  the  system  rather  than  a  central  governor.  Adaptability,  or  homeostasis,  is  the  regulation  of  a 
system’s  internal  environment  so  as  to  maintain  a  stable,  constant  condition  in  relation  to 
environmental  changes. 
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-  Many  agents  acting  in  parallel  in  an  environment  produced  by  its  interactions  with  other  agents 
in  the  system 

-  Because  the  agent  is  constantly  acting  and  reacting  to  the  other  agents'  actions,  nothing  in  its 
environment  is  fixed 

-  Control  is  highly  dispersed,  therefore  any  coherent  behaviour  there  might  be  in  the  system  has 
to  arise  from  competition  and  co-operation  among  the  agents  themselves 

-  Many  levels  of  organization,  agents  at  one  level  serving  as  building  blocks  for  the  next  level  up 

-  Constant  rearrangement  of  the  building  blocks  as  a  result  of  learning,  experience,  evolution, 
adaptation 

-  All  anticipate  the  future  to  some  degree,  making  attempts  at  prediction  on  the  basis  of  models 
of  their  environment 

-  All  have  niches  they  can  exploit,  filling  up  one  niche  often  opening  up  new  ones  that  can  be 
exploited  they  never  reach  equilibrium 

-  They  can  improve  on  some  dimensions,  but  never  optimize 

-  The  richness  of  the  interactions  within  the  system  allows  the  system  as  a  whole  to  undergo 
spontaneous  self-organization 

Figure  7:  Characteristics  of  Compiex  Adaptive  Systems.  John  H.  Holiand.  Hidden  Order:  How  Adaptation  Buiids 

Compiexity.  New  York,  New  York:  Basic  Books,  1995. 


As  a  model  for  organizations,  complexity  theory  has  a  major  impact  on  modem 
organizational  theory.  Some  would  even  that  cyberspace,  despite  being  non-biological, 
manifests  such  emergent  properties.  In  fact,  from  an  overall  warfighting  standpoint,  the  United 
States  Marine  Corps  elevated  complexity  theory  as  its  fundamental  viewpoint  for  warfighting 
and  explicitly  views  warfighting  organizations  as  complex  systems. The  Marine  Corps  based 
its  doctrinal  decision  on  John  Boyd’s  “Organic  Design  for  Command  and  Control”  (Figure  8)  in 
support  of  its  all-important  maneuver  warfare  doctrine.  However,  viewing  Boyd’s  design  as 
simply  a  model  for  maneuver  warfare  diminishes  its  conceptual  sophistication  as  a  much  broader 
model  for  organizational  complexity  in  the  face  of  complex  operating  environments.  In  this 
regard,  Boyd  was  well  ahead  of  his  time  and  in  fact  has  much  in  common  with  Stafford  Beer  and 
his  Viable  System  Model. 
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Source:  Boyd,  “Organic  Design  for  Command  and  Control”  1987,^^ 

Boyd’s  model  more  closely  resembles  a  heterarchy.  As  an  organizational  form,  a 
heterarchy  more  closely  matches  the  requirements  of  a  viable  system  or  a  complex  adaptive 
system.  A  heterarchy  is  well  suited  to  handling  challenges  from  the  environment  that  call  for 
flexibility  and  adaptability.  In  a  heterarchy,  authority  is  laterally  rather  than  vertically 
distributed  and  has  no  fixed  superior  decision-making  chain.  Heterarchies  are  characterized  by 
interdependent  relationships,  dense  information  nets,  and  distribution  of  decision-making  power. 
Organizational  members  participate  in  decision-making  regardless  of  their  functional  role, 
position,  or  rank.  The  premium  for  decision-making  authority  is  based  on  knowledge  and 
competence  in  solving  problems  rather  than  rank  or  time  served  in  the  organization.  In  addition, 
heterarchies  process  more  information  and  use  it  more  effectively  than  hierarchies. 
Communications  channels  are  dynamic  and  are  created  and  modified  to  reflect  the  needs  of  a 
particular  situation  or  event.  This  ability  to  dynamically  adapt  to  changing  situation  can  be 
viewed  as  a  way  of  employing  requisite  variety.  The  emphasis  on  knowledge  contributes  to  the 

capacity  of  a  heterarchy  to  generate  a  variety  of  solutions  to  problems  that  face  the  organization. 
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Heterarchies  have  a  greater  ability  to  quickly  integrate  information  from  multiple  sources  and 
achieve  flexibility  in  order  to  adapt  to  changing  circumstances.  A  member  of  a  heterarchy  can 
be  connected  to  any  other  members  without  needing  to  go  through  or  get  permission  from 
anyone.  In  this  way,  a  heterarchy  distributes  privilege  and  decision-making  among  participants, 
in  contrast  to  a  hierarchy  which  assigns  more  power  and  privilege  to  the  members  high  in  the 
structure.  Figure  9  outlines  typical  characteristics  of  heterarchies. 


Emphasizes  temporary  associations  out  of  a  pool  of  people  rather  than  permanent 
structures  and  changing  people 

Overlap  of  responsibility  is  viewed  as  an  advantage 

Knowledge  resident  throughout  the  organization  and  valued  wherever  it  exists 
Emphasizes  lateral  communication  over  vertical  communication 
Strategic  nodes  can  emerge  at  any  place  in  the  organization  based  on  environmental 
contingencies  and  where  the  requisite  knowledge  to  solve  the  problem  exists 

The  upper  levels  of  the  organization  are  viewed  as  orchestrators  of  communication 
rather  than  solely  agents  of  control,  monitoring,  and  resource  allocation 

Strategy  is  a  product  of  contributions  across  the  network  rather  than  formulation  and 
dissemination  by  higher  headquarters 

Figure  9:  Characteristics  of  Fleterarchies. 

There  are  downsides  to  cybernetics,  systems  theory,  and  heterarchies.  Save  for  Boyd’s 
theories,  the  major  critique  of  cybernetics  and  systems  theory  is  that  they  do  not  explicitly 
incorporate  human  agency  or  moral  factors.  The  human  aspects  of  interaction,  cognition, 
relationships,  and  the  moral  and  emotional  aspects  of  conflict  and  cooperation  are  perceived  to 
be  immaterial  to  the  function  of  the  system  and  its  output.  In  effect,  these  approaches  reduce 
humans  to  mere  parts  or  black  boxes  making  the  models  necessarily  incomplete.  With  regard  to 
complexity  theory,  its  concrete  scientific  applications  are  so  constrained  (e.g.  cellular  behavior) 
that  the  generalization  of  the  theory  to  broader  classes  or  complex  systems,  especially  complex 
systems,  is  called  into  question.  With  regard  to  heterarchies,  a  significant  investment  of  time, 
energy,  and  administrative  and  technical  support  infrastructure  is  needed  to  maintain  the  dense 
communications  nets  required  to  keep  information  flowing  at  the  volumes  required  for  effective 
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collaboration,  coordination,  and  action.  In  addition,  the  bias  toward  consensus  in  decision¬ 
making  in  heterarchies  creates  the  potential  for  confusion,  sluggish  response  (although  the 
response  may  be  perfectly  appropriate,  it  is  late  to  need),  and  gridlock.  Finally,  the  lack  of  a 
central  governor  or  preseribed  chain  of  authority  in  a  heterarchy  results  in  difficulty  in  achieving 
global  optimization,  long-term  plans  of  aetion,  and  predietable  performance. 

COGNITIVE-PSYCHOLOGICAL  MODELS 

As  a  remedy  to  the  issues  associated  with  cybernetics-systems  models,  several  efforts 
have  been  made  to  addresses  cognitive  and  psyehological  factors  in  command  and  control.  Carl 
Builder’s  “Command  Concept  C2”  is  one  sueh  effort.  Builder’s  analysis  is  “driven  by  the 
need  to  separate  the  intellectual  performanee  of  the  commander  from  the  technical  performanee 
of  the  C2  system.”^^  He  further  states  that  the  “. .  .essence  of  eommand  lies  in  the  cognitive 
processes  of  the  Commander.”^'*  Emphasis  is  plaeed  on  preparation  for  battle  using  the  C2 
system  rather  than  orchestration  and  improvisation.  In  addition,  information  is  viewed  as 
important  when  developing  the  command  concept,  but  real-time  information  is  not  especially 
relevant  to  altering  the  outeome  of  a  conflict.  In  this  regard.  Command  Concept  C2  diverges 
dramatieally  from  the  cybernetie-systems  view  which  holds  that  information  is  essential  to 
adaptation.  However,  in  the  end.  Builder’s  theory  is  cybernetic  in  nature:  “The  formulation  and 
transmission  of  the  commander’s  coneept  eould  be  considered  as  the  eontent  of  the  C2 
system. . This  means  that  the  Command  Concept  C2  would  have  to  be  integrated  into  an 
overall  C2  model,  whieh  in  all  likelihood  would  be  cybernetie.^' 

Another  cognitive-psychological  approach  has  been  formulated  by  Ralph  Stacey  that 
incorporates  relationship  psyehology  to  account  for  human  interaction.  Stacey  is  a  proponent 
of  complexity  theory,  but  believes  it  has  been  misapplied.  His  approach  is  in  part  a  reaction  to 
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the  functionalist  point  of  view  embedded  in  all  systems  thinking,  "I  think  that  the  radical 
potential  of  theories  of  chaos  and  dissipative  structures  for  organization  theory  tends  to  be 
obscured  by  simulations  of  this  kind  because  the  agents  in  the  system  are  treated  in  an 
impersonal  way.”  Instead,  he  takes  a  constructivist  approach  and  proposes  organizations  as 
“complex  responsive  processes”  based  on  interacting  themes,  conversations,  and  relationships. 

In  other  words,  members  of  the  organization  continuously  build  an  organizational  narrative  and 
thereby  shape  and  reshape  the  power  relationships  and  actions  that  the  organization  takes  to  deal 
with  its  environment.  Stacey’s  approach  is  not  so  much  a  model  as  it  is  a  competing 
philosophical  viewpoint  that  places  human  interaction  at  the  center  of  organizations.  It  is  human 
to  human  interaction  that  exercises  “ordinary  daily  human  freedom. .  .to  weave  actions  into  and 
around  the  system. .  .in  order  to  cope”  with  the  environment  and  “get  things  done.”^"^  Stacy 
presents  a  compelling  case,  but  at  the  moment  it  remains  a  theoretical  one.  Although  models  for 
complex  responsive  processes  could  emerge  over  time,  at  the  moment  the  theory  remains  just 
that,  theory. 


THE  HYBRID  FORM 

Both  hierarchies  and  heterarchies  have  strengths  and  weaknesses.  A  critical  weakness  of 
hierarchies  is  that  it’s  top-down,  authority-driven  structure  does  not  have  the  requisite  variety  to 
respond  to  the  VUCA  cyberspace  environment.  On  the  other  hand,  heterarchies  lack  a 
mechanism  to  provide  for  global  direction  and  predictable  performance.  Another  organizational 
option  is  to  combine  the  strengths  of  both  and  minimize  their  weaknesses  in  order  to  provide  the 
means  to  resolve  the  need  for  control  and  direction  on  the  one  hand  and  flexibility  and  adaptation 
on  the  other.  A  hybrid  organization,  properly  designed,  employs  the  best  attributes  of  hierarchy 
and  heterarchy.  Command  and  control  in  a  hybrid  organization  moves  away  from  the  traditional 
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C2  model  by  uncoupling  command  from  control. Command  involves  the  making  of  strategy 
and  setting  conditions  for  action  through  planning,  resourcing,  and  facilitating  information  flow 
throughout  the  organization.  Control  is  not  a  function  of  command,  but  emerges  as  a  function  of 
organizational  structure;  resource,  information,  and  knowledge  flows;  and  the  environment 
(which  includes  adversaries).^^  Beer’s  Viable  System  Model  exemplifies  this  approach. 

From  a  military  standpoint,  a  key  example  of  the  hybrid  form  was  exhibited  during 
World  War  I  on  the  Western  Front  when  the  German  Army  formally  implemented  storm  trooper 
tactics  to  break  the  stalemate  of  trench  warfare  with  its  lethal  concentration  of  industrial  age 
firepower.  The  Germans  relied  heavily  on  Auftragstaktik,  or  mission  type  orders  as  an  approach 
to  operations  wherein; 

“A  military  commander  gives  their  subordinate  leaders  a  clearly  defined  goal  (the 
mission)  and  the  forces  needed  to  accomplish  that  goal  with  a  time  within  which  the  goal  must 
be  reached.  The  subordinate  leaders  then  implement  the  order  independently.  The  subordinate 
leader  is  given,  to  a  large  extent,  the  planning  initiative  and  a  freedom  in  execution  which  allows 
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flexibility  in  execution.  Mission-type  tactics  free  higher  leadership  from  tactical  details.” 

To  be  sure,  Auftragstaktik  is  a  way  of  increasing  the  autonomy  of  the  military 
organization,  its  capacity  to  maneuver  quickly,  and  the  initiative  of  its  individual  members  in  the 
face  of  a  more  complex  and  deadly  battlefield  environment.  In  effect,  it  patches  around  the 
inflexibility  of  a  standard  hierarchical  organization  and  in  its  own  way  uniquely  addresses  the 
Clausewitzian  realities  of  emotion,  chance,  and  friction  in  the  VUCA  environment.  Even  though 

mission-type  orders  are  institutionalized  as  part  of  US  warfighting  doctrine,  this  does  not  go  near 
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far  enough  to  allow  the  Armed  Forces  to  succeed  in  the  hypercompetitive  cyberspace  domain. 
Although  not  touted  as  such,  the  concept  of  network-centric  warfare  has  the  potential  to  move 
the  Armed  Forces  toward  a  hybrid  organizational  form  more  in  tune  with  the  requirements  of  a 
VUCA  cyberspace  environment.  To  do  this,  network-centric  warfare  should  not  be  viewed  as  a 
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“value  proposition”  or  “new  form  of  warfare”^^  but  rather  as  a  way  to  inerease  the  requisite 
variety  of  military  organizations  to  deal  with  the  VUCA  environment.  Quite  simply,  an 
organization  that  is  networked  and  provisioned  with  rich  information  flows,  reconfigurable  (and 
highly  automated)  processes,  knowledge-based  practitioners,  and — especially  key — control 
flexibility  will  display  a  greater  capacity  to  successfully  adapt  to  internal  and  external  threats  and 
exploit  emerging  opportunities.  This  type  of  organization  blends  the  best  of  the  hierarchical  and 
heterarchical  organizational  forms  and  best  applies  to  the  cyberspace  domain. 
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CRITERIA  FOR  CYBERSPACE  COMMAND  AND  CONTROL 


Based  on  the  above  analysis,  we  argue  that  the  historieal-traditional  model  of  C2  is 
inappropriately  restrietive  for  the  eyberspaee  domain.  What  is  needed  is  an  approaeh  to  C2  that 
allows  more  flexibility  to  eoneeptualize  and  mateh  the  fundamental  purpose  of  C2  to  the 
environment  in  which  it  is  exercised.  As  stated  previously,  we  use  Bremer  and  Orr  who  view  the 
purpose  of  C2  as  the  direction  and  coordination  of  operations  to  produce  desired  effects 
according  to  commander’s  intent  through  the  positioning  of  forces  at  the  time  and  place  they  are 
needed.’”  In  addition,  we  adopt  the  positions  of  Builder  and  Georgiy  Levchuk  et  al.,  and 
indirectly,  Volberda,  who  all  advocate  the  conceptual  de-linking  of  command  from  control.  In 
this  view,  the  role  of  command  is  to  continually  survey  the  internal  and  external  environments 
and  ensure  the  organization’s  inputs,  processes,  interactions,  and  information  flows  are  calibrated 
properly  to  achieve  the  organization’s  goals.  Command  involves  the  surveying,  contemplating, 
and  monitoring  of  the  organization’s  fitness  to  the  environment,  and — when  necessary— directing 
adjustments  to  the  organization’s  structure  in  order  to  assure  ongoing  performance  and  survival. 
On  the  other  hand,  control  is  distributed  throughout  the  organization  and  supported  by  dense  nets 
of  information  flows,  interactions,  and  knowledge-based  decision-making  and  engagement 
within  the  organization  and  with  the  environment. 

The  environment  in  which  cyberspace  operations  are  conducted  produces  certain 
mandatory  requirements  for  the  Armed  Forces  to  successfully  compete  in  the  domain.  The 
VUCA  strategic  environment;  the  speed,  multi-dimensional  complexity,  and  rapid  technological 
innovation  characteristic  of  cyberspace;  and  the  nature  of  competition  and  change  in  cyberspace 
call  for  a  C2  function  that  can  continually  match  this  environment  and  impact  the  environment 
itself  for  the  benefit  of  the  objectives  for  which  cyberspace  operations  are  employed.  We 
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propose  seven  eriteria  for  eyberspaee  C2  that,  if  met,  will  plaee  the  Armed  Forees  in  a  position  to 
best  orehestrate  eyberspaee  operations.  These  eriteria  inelude  speed,  adaptability,  alertness, 
flexibility,  responsiveness,  resilienee,  and  effieiency. 

Speed  is  the  sine  qua  non  of  eyberspaee  operations.  Two  types  of  speed  are  needed  to 
eompete  in  the  eyberspaee  domain.  First,  the  eyberspaee  C2  funetion  and  the  teehnology  that 
supports  it  must  be  eapable  of  operating  at  speeds  that  enable  appropriate  responses  and 
preventive  actions.  The  speeds  required  will  be  variable,  but  should  incorporate  the  potential  to 
achieve  2/3  the  speed  of  light,  which  is  built  into  the  infrastructure  of  the  domain  itself  Second, 
cyberspace  organizations  must  exhibit  a  speed  of  adaptation,  planning,  innovation,  and 
implementation  that  meets  or  exceeds  the  rate  of  introduction  of  new  attack  vectors;  novel 
tactics,  techniques,  and  procedures;  and  technological  innovation  and  implementation.  This  type 
of  speed  is  necessarily  slower  than  the  information  flows  that  transit  cyberspace,  however 
without  it,  cyberspace  C2  would  not  be  capable  of  the  adaptation  needed  to  maximize  the 
opportunity  offered  by  the  raw  speed  of  the  domain. 

The  hypercompetitive  nature  of  cyberspace  is  characterized  by  continuous  change  and 
innovation.  This  requires  an  adaptable  organization  that  is  able  through  its  C2  capability  to  1) 
correctly  perceive  and  appropriately  deal  with  the  external  environment,  2)  maintain  high  levels 
of  information  exchange  and  cooperation  within  the  organization  in  order  to  formulate  options, 
and  3)  dynamically  restructure  processes,  decision-making  relationships,  and  behaviors  to 
effectively  implement  change  options  to  deal  with  the  external  environment.  In  terms  of 
warfighting,  cyberspace  C2  must  be  adaptable  in  the  face  of  all  types  of  threats,  across  the  entire 
range  of  military  operations,  and  all  levels  of  war:  strategic,  operational,  tactical.  The  criteria  of 
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alertness,  flexibility,  responsiveness,  and  resilienee  are  driven  by  the  requirement  for  speed  and 
are  direetly  related  to  adaptability. 

Alertness  refers  to  timely  awareness  of  existing  or  antieipated  ehanges  internal  to  the 
organization  or  in  the  operating  environment. Alertness  implies  a  multi-dimensional 
understanding  of  the  current  and  projected  status  of  the  cyberspace  domain  in  relation  to  the 
larger  operational  environment.  Alertness  includes  the  capacity  for  situational  awareness  of  the 
technical  parameters  that  comprise  the  cyberspace  infrastructure.  Particularly  important  is  the 
anticipation  of  adversary  action  and  innovation,  an  area  that  requires  the  intense  application  of 
intelligence  operations.  In  addition,  it  points  the  organization  toward  the  threats  and 
opportunities  associated  with  emerging  capabilities  and  innovations  and  how  the  organization 
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might  deal  with  a  threat  or  capitalize  on  an  opportunity. 

According  to  Volberda,  control  flexibility  is,  “the  degree  to  which  an  organization  has  a 
variety  of  managerial  capabilities  and  the  speed  at  which  they  can  be  activated  to  increase  the 

7-5 

control  capacity  of  management  and  improve  the  controllability  of  the  organization.” 

Flexibility,  then,  can  be  viewed  as  the  governor  of  adaptability  and  management’s  most 
important  C2  task.  Without  it,  an  organization  could  fail  to  adapt  or  become  a  series  of  mindless 
adaptations  leading  to  disintegration.  It  follows  that  cyberspace  C2  must  be  flexible  enough  to 
continue  to  operate  in  new  or  changed  scenarios  rather  than  remaining  set  in  static 
configurations. 

Responsiveness  refers  to  the  change  capacity  of  an  organization’s  processes  once  it  is 
found  that  adjustments  must  be  made  to  positively  adapt  to  internal  or  external  threats  and 
opportunities.^"^  Responsiveness  relates  to  the  development  of  variety  in  the  choice  and  design  of 
C2  processes  in  order  to  ensure  that  information  inputs  and  decisions  are  transformed  into  the 
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effects  needed  for  a  particular  situation  appearing  in  the  environment.  Responsive  processes 
must  be  rapidly  reconfigurable  (polymorphic),  automated  where  possible,  and  supported  by 
appropriate  levels  of  information,  knowledge,  competence,  resources,  and  a  cultural  bias  in  the 
organization  that  understands  and  supports  the  need  for  change. 

Resilience  is  the  ability  of  cyberspace  C2  to  withstand  attack  or  other  forms  of  significant 
shock  and  discontinuity.  A  resilient  cyberspace  C2  capability  would  enable  an  organization  to 
continue  to  operate,  adapt,  and  survive  in  the  VUCA  cyberspace  environment  in  the  face  of 
damage,  degradation,  disruption,  or  destruction. 

Cyberspace  C2  efficiency  relates  to  how  well  information,  time,  and  resources  are  used 
throughout  the  organization  to  feed  processes  and  decision-making  in  order  to  produce  the 
desired  output  in  the  fastest,  most  economical,  and  highest  quality  way.  In  practice,  cyberspace 
C2  efficiency  can  also  reduce  the  deployed  footprint,  decrease  the  demand  for  scarce  resources 
and  leverage  economies  of  scale  across  time  and  space.  Achieving  cyberspace  C2  efficiency 
requires  a  well-designed  technical  architecture,  high-volume  yet  appropriately  tailored  and 
calibrated  information  flows,  multi-dimensional  situational  awareness,  and  well  trained  and 
education  practitioners. 

To  be  sure,  this  set  of  criteria  is  abbreviated.  However,  they  are  based  on  solid  academic 
research  and  practical  experience  of  today’s  operational  environment,  and  therefore  for  our 
purposes  they  are  sufficient  to  begin  to  relate  the  requirements  of  the  cyberspace  domain  to  the 
choice  of  an  appropriately  matched  C2  model.  If  one  assumes  that  C2  is  as  essential  for 
cyberspace  operations  as  it  is  in  any  other  warfighting  domain,  the  question  at  hand  becomes 
what  is  the  best  form  of  C2  to  exercise  command  and  achieve  desired  military  results  in 
cyberspace?  Although  it  stands  to  reason  that  cyberspace  operations  share  similar  C2  elements 
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as  other  warfighting  domains  such  as  organization;  technical  systems;  and  tactics,  techniques, 
and  procedures;  we  assert  that  the  most  effective  C2  method  for  cyberspace  operations  will  be 
heavily  influenced  by  the  nature  of  the  domain  itself  and  the  environment  within  which  it 
exists 
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EVALUATION  OF  MODELS 


In  order  to  arrive  at  a  deeision  regarding  whieh  C2  model  to  reeommend,  we  developed  a 
straightforward  deeision  matrix  to  evaluate  eaeh  model  based  upon  the  seven  eriteria  we 
deseribed  earlier.  We  ehose  the  deeision  matrix  beeause  we  felt  this  tool  would  help  us  arrive  at 
a  quantitative  decision  even  though  the  evaluation  of  how  each  model  met  the  criteria  is 
subjective.  We  will  explain  how  we  arrived  at  each  of  our  evaluations  later  in  the  paper. 

We  grouped  the  various  C2  constructs  discussed  earlier  into  three  bins  for  the  purpose  of 
evaluation.  These  groupings  centered  on  hierarchical,  heterarchical  and  hybrid  C2  models.  The 
matrix  is  filled  in  using  a  scale  of  1  to  5  with  1  being  the  least  effective  and  5  being  the  highest. 
We  did  not  weight  any  criteria  higher  than  any  other  due  to  the  fact  that  we  felt  each  item  was 
equally  important  to  the  evaluation  of  the  C2  models. 


Hierarchical 

Heterarchical 

Hybrid 

Speed 

3 

4 

5 

Adaptability 

1 

3 

3 

Alertness 

3 

5 

5 

Flexibility 

1 

3 

3 

Responsiveness 

3 

5 

5 

Resilience 

5 

1 

5 

Efficiency 

3 

3 

4 

TOTALS 

19 

24 

30 

As  discussed  in  previous  chapters,  the  hierarchical  model  is  not  quick  to  react  to  change 
in  the  environment  nor  is  it  a  very  quick  method  to  disseminate  orders  from  top  to  bottom.  This 
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is  due  to  the  necessary  vetting  and  approval  process  that  a  hierarchical  organization  employs. 

The  heterarchical  model  is  very  quick  due  to  its  distributed  nature  and  reliance  upon  very 
distributed  decision  making.  However,  unlike  the  hierarchical  model,  there  is  a  significant  loss 
in  uniform,  homogenous  decision-making  and  synchronized,  macro-oriented  direction.  The 
hybrid  model,  while  not  as  quick  to  disseminate  orders,  still  retains  lower  level  decision  making 
authority  which  enables  local  C2  of  an  issue  while  still  incorporating  the  best  aspects  of  a 
hierarchical  command  structure.  This  allows  time  to  be  used  most  efficiently  at  multiple  layers 
within  this  model  due  to  each  organization  working  their  level  of  the  action. 

A  heterarchical  system  is  adaptable  depending  upon  the  local  organization.  How  the 
lower  echelons  of  command  decide  to  adapt  to  a  certain  situation  results  in  a  disjointed  and 
inconsistent  effort  across  the  spectrum  as  one  organization  will  adapt  to  a  changing  environment 
one  way  while  another  adapts  differently.  While  there  should  be  resilient  communication  flows 
between  the  organizations  and  best  practices  and  lessons  learned  passed,  this  does  not  mean  that 
these  will  necessarily  be  incorporated.  In  contrast,  the  hierarchical  C2  structure  is  adaptable  only 
so  far  as  the  parent  command  allows.  In  today’s  remote,  deployed  environment,  commanders  far 
removed  from  the  scene  may  not  fully  understand  the  problem  set  or  the  need  to  deviate  from 
established  parameters.  Additionally,  the  downward  directed  adaptation  may  fall  well  short  in 
time  and  purpose  of  what  is  needed  at  the  local  level  and  may  not  be  feasible  across  the  entire 
cyberspace  domain.  The  hybrid  C2  structure  results  in  an  organization  that  can  adapt  as  the 
situation  presents  itself  while  still  conforming  to  an  established  set  of  goal-oriented  guidelines. 

Assuming  a  level  playing  field  (sufficient  and  similar  technologies  deployed  across  the 
three  models),  we  believe  that  all  three  models  can  achieve  similar  levels  of  alertness.  The 
technological  advances  of  the  last  decade  enable  commanders  in  all  domains  of  warfare  to  be 
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cognizant  of  the  lowest  level  of  taetieal  events  on  the  battlefield.  So  it  ean  be  with  eyberspaee. 

It  is  feasible  for  any  C2  strueture  within  eyberspaee  to  be  aware  of  the  lowest  level  event,  to 
monitor  it,  and  direet  notions  to  mitigate  the  seriousness  of  the  event.  We  oould  not  disoern  a 
differenoe  between  the  three  models  worthy  of  distinotion. 

As  with  adaptability,  the  hybrid  model  is  the  most  flexible  of  the  three.  As  stated  before, 
oombining  the  best  attributes  of  eaoh  allows  for  a  C2  strueture  that  ean  ohange  based  upon 
looalized  mission  requirements  while  still  retaining  a  similar  enough  strueture  that  it  retains 
strong  similarities  to  others.  The  hierarohioal  model,  again,  will  flex  as  muoh  as  parent 
oommands  allow,  whioh  may  be  not  enough  for  the  situation  and  may  not  apply  or  be  useful  to 
the  entire  hierarehieal  C2  strueture.  The  same  adaptability  detraetors  for  the  heterarehieal  model 
apply  here  as  well. 

Assuming  proper  intelligenee  and  warning,  a  hierarehieal  model  ean  be  very  responsive. 
To  pretend  otherwise  would  be  dismiss  eenturies  of  warfare  and  all  relevant  examples.  There 
are,  obviously,  examples  where  intelligenee  and  warning  was  not  available  or  properly  utilized 
(the  attaek  at  Pearl  Harbor  as  an  example)  however  this  is  not  indieative  of  the  entire  C2  model. 
Likewise,  a  heterarehieal  model  ean  also  be  exeeptionally  responsive  aeross  the  entire  range. 
However,  onee  again,  one  does  run  into  the  disjointed  approaeh  that  a  heterarehieal  model  would 
employ  aeross  the  entire  eyberspaee  domain.  Onee  again,  the  hybrid  model  would  enjoy  the 
benefits  of  being  responsive  to  an  event  while  working  within  the  hierarehieal  guidanee. 

Both  the  hybrid  and  hierarehieal  models  would  prove  to  be  resilient.  By  virtue  of  their 
nature,  these  two  models  enjoy  the  advantages  of  parent  eommand  struetures  enabling  higher 
level  eommands  to  implement  initiatives  to  deal  with  eventualities.  These  types  of  issues  eould 
range  from  the  physieal  destruetion  of  a  site  to  the  failure  of  a  loeal  organization  to  implement 
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certain  actions  designed  to  proteet  the  entire  eyberspaee  domain.  However,  a  heterarehieal 
organization  eould  not  benefit  from  a  resilient  eommand  strueture  that  would  enable  it  to  survive 
multiple  failures  (regardless  of  souree,  duration,  or  effect)  without  serious  degradation  of  the 
domain. 

Onee  again,  assuming  a  level  playing  field,  all  of  these  C2  models  ean  be  efficient  -  there 
is  no  salient  feature  of  the  models  that  eause  any  to  be  unneeessarily  ineffieient.  The 
heterarehieal  model  eould  be  the  most  ineffieient  of  all  three.  While  it  ean  execute  with  minimal 
overhead,  the  disparate  nature  of  the  model  results  in  inereased  overhead  in  training  varianees 
eoupled  with  teehnieal  variances.  The  hierarchieal  model  is  likewise  ineffieient  in  that  it  seeks 
an  overall  approaeh  to  events  and  ean  be  ineffieient  in  alloeation  of  resourees  and  eommand 
guidance  to  deal  with  cyberspace  events.  The  hybrid  model  ineorporates  the  strengths  of  both  as 
it  enables  C2  that  is  as  effieient  as  the  other  attributes  of  the  domain  and  C2  model  allow. 
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RECOMMENDATIONS 


The  current  hierarchical  C2  structure  which  serves  other  domains  well  does  not  work  at 
optimal  levels  for  exercising  global  C2  of  our  newest  domain,  cyberspace.  Accordingly,  our 
research  and  analysis  points  to  a  new  model  to  be  embraced  by  the  DoD:  a  hybrid  model.  To  be 
sure,  this  model  possesses  its  own  unique  weaknesses  and  it  will  take  time  and  effort  to  fully  vet 
this  new  approach,  but  the  hybrid  model  is  the  strongest  of  the  three  we  analyzed  for  cyberspace 
C2.  Figure  10,  shown  below,  is  how  we  envision  the  command  and  informational  relationships 
in  this  new  model.  It  is  important  to  note  the  difference  between  the  command  and  informational 
connections.  We  believe  it  is  important  in  the  hybrid  model  that  information  about  the  domain 
as  a  whole  and  incidents  specifically  must  be  shared  quickly  and  without  prejudice  throughout 
the  domain  so  commanders  at  all  levels  can  take  the  necessary  actions  within  their  span  of 
control.  Important  to  note  is  that  information  flows  exist  at  and  between  all  levels  of  the  C2 
model  and  across  current  organizational  lines.  These  flows  enable  the  advantages  discussed 
previously  by  allowed  all  levels  of  command  to  tackle  problems  simultaneously  while  also 
ensuring  a  unified  higher  headquarters  command  approach.  Perhaps  most  importantly  for  this 
model,  the  power  to  respond  to  and  deal  with  events  is  placed  in  the  hands  of  personnel  who 
have  the  best  knowledge,  no  matter  their  rank.  Teams  are  then  rapidly  formed,  disbanded,  and 
re-formed  as  events  continue  to  ebb,  peak,  and  flow. 
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Figure  10:  Proposed  Hybrid  C2  Model 


The  next  model  below  shows  a  model  of  a  basie  organizational  element  of  the  hybrid 


model.  We  envision  that  these  organizations  will  utilize  this  basic  model  and  its  method  of 
command  and  control  to  become  part  of  a  learning  organization  where  all  levels  are  informed 
and  cognizant  of  events  and  activities,  regardless  of  where  these  occur. 


-  Guidance 

-  Policies 


Activities 

-Decision  making 
-  Policies 
-Actions 


Figure  11:  Organizational  implementation  of  the  hybrid  C2  model 
In  order  to  successfully  implement  the  hybrid  model,  it  will  be  necessary  to  identify, 
recruit  and  develop  a  new  set  of  “cyberspace  warriors”  who  receive  not  only  the  unique  training 
demanded  of  this  domain  but  also  the  training  and  education  regarding  the  new  C2  model  and 
how  they  are  to  operate  within  it.  As  author  Colonel  Thomas  Hammes,  USMC  states  in  his 
ground  breaking  treatise  on  Fourth  Generation  Warfare  (4GW),  it  will  necessary  to  “select  and 
promote  intelligent,  innovative  people  and  ensure  that  they  are  free  to  experiment  and  fail  - 
provided  they  learn  from  those  failures.”  Not  only  is  this  important  in  4GW,  it  will  also  be 
important  to  cyberspace  in  order  to  enable  “. .  .a  creative  member. . . [to]  literally  tap  the  world  for 
information,  ideas,  and  techniques  that  apply  to  his  or  mission.”^’  This  will  also  require  re- 
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educating  a  whole  new  cadre  of  leaders  who  understand  the  importance  of  unconstrained 
information  flow  and  how  command  must  be  employed  in  a  highly  adaptive  organization. 

There  will  also  be  a  need  to  increase  resource  assignment  in  this  domain.  In  order  to 
establish  these  robust  information  links  where  data,  intelligence,  and  information  regarding  the 
domain  is  passed  effortlessly  and  seamlessly,  resources  will  need  to  be  applied  to  enable  this 
connectivity.  Not  only  will  large  and  redundant  communications  link  need  to  be  installed,  but 
also  the  necessary  hardware  and  software  to  take  advantage  of  this  increased  sources  of 
information.  These  resources  must  be  implemented  such  that  these  organizations  embrace  the 
new  technologies  which  enable  fast,  adaptive  processes  using  distributed,  recombinant — and 
evolutionary— capability  based  on  threat  and  environmental  changes.  We  must  continue  to  move 
to  an  autonomic  technological  infrastructure  focusing  on  speed  and  “smart  automated” 
infrastructure  management. 

Additionally,  organizations  will  have  to  produce  new  doctrine  and  guidance  on  how  to 
deal  with  the  new  information  available  to  all.  Joint  Vision  2020,  originally  published  in  2000, 
is  on  target  -  information  superiority  and  the  use  of  it  is  a  requirement  for  successful  cyberspace 
dominance  as  is  network-centric  warfare,  properly  understood.  History  is  replete  with  examples 
of  information  being  available  but  not  acted  upon  with  disastrous  results  (e.g.  Pearl  Harbor  and 
Hooker  at  Chancellorsville). 

Changes  in  higher  level,  presidential-granted  authorities  will  also  be  required.  While  the 
2008  UCP  is  a  positive  step  forward,  the  lines  of  authority  are  still  confused,  ill-defined,  and 
ultimately  inappropriate  for  cyberspace  C2.  It  is  necessary  in  the  hybrid  model  set  the 
parameters  for  organizations  to  exercise  their  authority  in  a  productive,  collaborative  fashion. 
This  could  require  the  movement  away  from  the  investiture  of  the  cyberspace  domain  into  a 
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multi-role  functional  combatant  command  and  towards  a  domain-oriented  command  where  the 


power  of  cyberspace  can  be  maximized.  This  would  also  fulfill  the  tenants  of  unity  of  command 
and  unity  of  effort,  two  long  enduring  principles  of  warfare. 

Another  area  to  be  addressed  is  how  joint  and  coalition  forces  will  implement  and  work 
within  this  construct.  One  option  that  should  be  investigated  further  to  organize  and  employ 
joint  forces  in  accordance  with  the  hybrid  model  is  through  a  Joint  Force  Cyberspace  Component 
Commander  (JFCCC).  A  JFCCC  will  consolidate  the  planning  and  operations  functions 
currently  performed  by  the  various  J6  staffs  across  the  Combatant  Commands  and  place  them  in 
a  full-time  operational  command  structure.  Additionally,  it  will  elevate  the  cyberspace  domain 
on  par  with  similar  functional  components  such  as  the  JFACC,  JFLCC,  and  JFMCC.  Given  that 
events  are  occurring  continuously  in  cyberspace,  it  is  possible  that  the  JFCCC  could  be 
established  as  a  global,  full-time  component  of  STRATCOM.  Following  this  logic,  it  would  be 
necessary  to  extend  the  cyberspace  C2  model  on  a  world-wide  basis  and  ensure  additional 
linkages  to  the  operational  level.  To  this  end,  one  can  conceive  of  “cyberspace  coordination 
elements”  or  “Directors  of  Cyber  Forces  -  Forward”  embedded  within  the  other  combatant 
commands  and  service  components.  This  is  an  area  for  further  investigation  as  the  DoD  moves 
to  adopt  the  hybrid  model  for  cyberspace  C2. 
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CONCLUSION 


Based  on  the  results  of  this  study,  it  is  eiear  that  for  the  Armed  Forees  to  have  any 
realistic  chance  of  success  in  cyberspace,  it  must  acknowledge  that  the  hybrid  form  is  best 
matched  to  respond  to  the  hypercompetitive,  complex,  and  technological  nature  of  the 
cyberspace  domain.  The  hybrid  form  necessarily  moves  the  Armed  Forces  away  from  the 
doctrinal  superficialities  of  organizational  wiring  diagrams  and  traditional  military-bureaucratic 
biases  toward  hierarchies  and  vertical  control.  Instead,  with  the  hybrid  form,  cyberspace  C2  is 
established  upon  a  force  that  prizes  knowledge  ahead  of  rank  and  experience  and  that  is  bound 
together  by  rich,  ubiquitous  information  flows  that  connect  all  participants  at  all  levels  of  the 
cyber  fight.  It  is  able  to  achieve  high  operating  speeds  both  in  terms  of  the  raw  potential  of 
information  transfer  and  in  terms  of  adaptation,  planning,  dynamic  restructuring,  decision¬ 
making,  innovation,  and  implementation.  Such  an  organization  is  also  able  to  handle  the 
continuous  change  that  is  characteristic  of  the  domain. 

With  the  hybrid  form,  the  cyber  force  is  intrinsically  postured  to  meet  emerging  threats  at 
all  levels  of  war  due  its  alertness,  flexibility,  responsiveness,  and  resilience.  C2  is  based  on  a 
pervasive  understanding  of  the  internal  and  external  operating  environments,  where  decision¬ 
makers  translate  deep  situational  awareness  into  anticipatory  operational  responses,  scaled  and 
tailored  technologically  and  procedurally  to  the  situation.  Cyber  leaders  demonstrate  warfighting 
skill  according  to  their  ability  to  decisively  calibrate  the  control  needed  to  deal  with  an  event  and 
improve  the  controllability  of  the  organization  in  the  face  of  novel,  fast-developing  situations 
arising  from  the  larger  operational  environment.  These  leaders  are  also  the  guarantors  of  the 
principle  of  variety  in  the  choice,  design,  resilience,  and  efficiency  of  C2  processes.  In  the 
hybrid  model,  the  cyber  leader  is  the  governor  of  cyberspace  C2. 
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If  the  case  for  the  hybrid  form  is  convincing,  the  next  step  is  to  implement  it  throughout 
the  DoD.  In  that  regard,  a  JFCCC  is  a  potential  solution  providing  a  solid  doctrinal  basis  for 
warfighting  organization  while  also  setting  the  stage  to  go  beyond  traditional  doctrinal  notions  of 
C2  as  applied  to  the  exacting  requirements  of  the  cyberspace  domain.  The  JFCCC  organization 
must  embody  the  very  essence  of  the  hybrid  model  wherein  processes  are  rapidly  reconfigurable, 
automated,  and  supported  by  a  well-designed  technical  architecture,  high  quality  information 
flows,  deep  awareness,  and  thoroughly  educated  practitioners.  The  JFCCC  must  be 
simultaneously  global,  regional,  and  local  in  focus,  an  objective  that  will  be  achieved  through  the 
very  structure,  processes,  practice,  and  governance  of  the  hybrid  form  itself 

To  be  sure,  some  will  question  whether  the  hybrid  model  can  work  within  the  strict, 
hierarchical  environment  of  the  U.S.  military.  True,  our  argument  for  a  new  cyberspace  C2 
approach  is  not  exactly  new.  It  has  been  echoed  throughout  the  military  literature  since  the  onset 
of  the  “information  revolution”  in  the  1990’s,  and  the  DoD  has  been  wrestling  with  it  for  much 
of  that  time.  In  the  organizational  development  literature,  the  recognition  goes  back  to  the 
1960’s.  However,  what  is  new,  and  what  this  study  has  shown  is  that  the  evidence  for  the  need 
to  move  the  hybrid  model  is  irrefutable:  theory  has  merged  with  practice.  The  nature  of  the 
hypercompetitive  cyberspace  domain  is  such  that  the  DoD  must  change  its  approach  if 
cyberspace  military  superiority  is  to  be  achieved  now  and  into  the  future.  One  need  only 
recognize  the  astonishing  number  of  computer  network  intrusions  and  data  exfiltrations  to 
understand  the  scope  of  the  threat.  Even  our  most  sophisticated  weapons  systems  are  not 
exempt.  Increasingly  sophisticated  cyber  weaponry  is  readily  available  on  hacker  web  sites,  and 
attack  anonymity  is  easily  achieved  making  attribution  and  response  problematic.  Offensive 
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overmatch  is  the  rule  given  that  our  defenses  are  largely  reactive,  engineered  to  respond  after 
attacks  have  already  occurred,  if  they  are  detected  at  all.  As  the  world’s  most  technologically 
advanced  military,  the  Armed  Forces  are  absolutely  dependent  on  cyberspace  to  perform  their 
warfighting,  intelligence,  and  business  missions.  The  interdependent  joint  team  cannot  fight 
without  cyberspace. 

That  is  why,  at  its  heart,  this  study  is  an  urgent  call  for  radical  cyberspace  C2  reform 
across  the  DoD.  In  order  to  meet  the  challenge  of  cyberspace  operations  today  and  into  the 
future,  the  Armed  Forces  must  move  away  from  its  traditional,  hierarchical  C2  structure. 

Instead,  it  must  embrace  the  hybrid  model  and  the  opportunities  for  warfighting  performance 
offered  by  the  establishment  of  a  JFCCC  structured  along  the  lines  of  the  model.  We  further  call 
upon  all  cyberspace  leaders  to  fight  and  overcome  the  endemic  bureaucratic  pathologies  that 
mitigate  against  the  needed  change.  Nothing  less  that  the  Armed  Forces’  ability  to  fight  and  win 
the  nation’s  wars  is  at  risk. 
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